mass.report
Scan Intelligence Report0/100
low Risk
exodus.com.ag
https://exodus.com.ag
IP
144.31.231.231 · NekoClaw Ltd
Location
Bern, Switzerland
Domain Age
—
HTTP
200 · 14.1s
SSL
—· R13, Let's Encrypt, US
Status
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
exodus
Vendors
28/31
Status
partial
✓ brightcloud✓ polyswarm✓ sophos✓ microsoft✗ chainpatrol✓ drweb✓ eset✓ bitdefender✓ avast✓ apple✓ spamhaus✓ openphish✓ emsisoft✓ netcraft✓ cisa✓ phishtank✓ yandex✗ avg✗ norton✓ urlscan✓ apwg✓ isitphish✓ phishreport✓ urlquery✓ virustotal✓ urlabuse✓ google✓ mcafee✓ threatyeti✓ kaspersky✓ fortiguard
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Exodus.com (domain impersonation signal; brand text detected via domain intelligence but page shows generic parked message)
Unknowntechnology | finance | ecommerce | other · 7/19/2026
Summary
The page at exodus.com.ag presents a generic parked-domain message, but the domain contains the brand name 'exodus', suggesting potential impersonation signals. There is no credential harvesting or login UI detected; the HTML shows a simple parked page with no forms. Network requests are limited to the page itself and a call to api.ipify.org, which does not indicate legitimate brand usage. Overall, evidence does not confirm active phishing, but the domain suggests possible brand impersonation risk due to mismatch between domain and brand.
Evidence Summary
▸Observed 2 capture stage(s); canonical stage is settled_render.
Capture
Stages: 2
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 1
Hosts: 1
Domains: 1
Observed Signals (1)
Minimal static content with parked-domain UI; no credential capture forms observed.
Observed Indicators (0)
No suspicious indicators identified
Risk AssessmentUsed in abuse reports
The domain exhibits impersonation risk due to the brand name appearing in the domain (exodus). However, the page content is a generic parked message with no credential collection or malware delivery evidenced in the scan. This should be monitored for potential abuse, as attackers may later populate the page with phishing UI impersonating Exodus. The lack of a real brand-hosted page reduces immediate phishing risk, but the brand-named domain warrants registrar/hosting awareness and potential takedown if used for impersonation.
Recommended Action
Monitor
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API