exodu6[.]com

Analysis of exodu6.com indicates that the domain was registered on February 21, 2026 through Gname.com Pte. Ltd. and resolved to the Cloudflare IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The site employed Cloudflare’s TLS Issuing ECC CA 3 certificate, confirming the use of Cloudflare’s SSL infrastructure. Technical fingerprints show the presence of Vue.js, Cloudflare Browser Insights, and HTTP/3, consistent with a modern web stack hosted behind Cloudflare’s edge network. The page title returned by the server was "编组 21," providing no direct indication of the intended malicious content. The domain is classified under the scam type "Brand Impersonation" and specifically targets the Exodus brand, as noted in the intelligence feed.

Detection data reveal that VirusTotal flagged the domain by 11 of 93 security vendors, and Google Safe Browsing labeled it as a social engineering threat. Independent blocklists including PhishDestroy, MetaMask, and SEAL have added the domain to their watchlists, and the site appears on three additional security blocklists. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The nameservers listed are lia.ns.cloudflare.com and venkat.ns.cloudflare.com, both belonging to Cloudflare, indicating that the domain’s DNS resolution is fully controlled by the provider.

The current operational status is offline, suggesting that the phishing infrastructure has been taken down or is temporarily inactive. However, the combination of a recent registration date, low trust score, multiple vendor detections, and confirmed brand impersonation indicates a high risk profile. Defenders should continue to block exodu6.com at perimeter and endpoint layers, monitor for any re‑activation of the domain or related sub‑domains, and update threat intelligence feeds with the observed indicators.