exodus-rewards[.]com

This domain, exodus-rewards.com, is identified as a brand impersonation threat specifically targeting users of the Exodus cryptocurrency wallet platform. The site mimics legitimate Exodus reward programs or promotions, likely designed to deceive visitors into connecting their wallets or entering sensitive credentials. Such impersonation schemes often serve as precursors to crypto drainer attacks, where malicious scripts automatically siphon funds from connected wallets without user consent. The domain's infrastructure and content patterns align with known crypto-focused phishing campaigns observed in recent months. Analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on February 21, 2026, through REALTIME REGISTER B.V., with a creation date suggesting potential domain squatting or preemptive registration for fraudulent purposes. It resolves to IP address 172.67.210.217 and is currently flagged by 6 out of 95 security vendors on VirusTotal. The domain appears on three independent security blocklists and is referenced in one AlienVault OTX threat intelligence pulse. The page title, about:privatebrowsing, indicates either cloaking behavior or an incomplete deployment, both common in phishing infrastructure. Users who visited exodus-rewards.com should assume potential exposure and take immediate corrective action. Disconnect any wallets previously linked to the site and revoke access via wallet management interfaces. Scan local devices for malware using updated security tools, focusing on browser extensions or scripts that may have executed during the visit. Monitor connected wallet addresses for unauthorized transactions and consider migrating funds to new addresses if suspicious activity is detected. Report the domain to relevant security teams or blocklist providers to aid in broader threat mitigation efforts.