mail-exodus[.]com

The domain mail-exodus.com is identified as a high-risk brand impersonation domain targeting Exodus. The domain is currently offline and has been taken down as part of ongoing security measures.

Analysis indicates that mail-exodus.com was registered on March 11, 2025, through OwnRegistrar, Inc. The domain has a Gridinsoft trust score of 0/100, indicating a severe lack of trustworthiness. It is flagged by 16 out of 95 VirusTotal security vendors, suggesting it has been recognized as malicious by a significant portion of the security community. Infrastructure analysis reveals that the domain resolves to the IP address 103.224.182.252. Additionally, the domain appears on three security blocklists and is blocked by MetaMask, PhishDestroy, and SEAL. The page title found on the domain is 'ww25.mail-exodus.com', which further corroborates its intent to impersonate the Exodus brand.

Given the current status of the domain being offline, it is recommended that all systems and networks continue to monitor for any signs of reactivation. Organizations should update their security policies to include this domain in their blocklists and ensure that employees are aware of the potential risks associated with brand impersonation attacks. Additionally, any users who may have interacted with this domain should be instructed to change their passwords and monitor their accounts for any unusual activity.