wallett-exoduss-innus[.]wasmer[.]app

This domain, wallett-exoduss-innus.wasmer.app, poses a targeted brand impersonation threat against Exodus cryptocurrency wallet users. The site presents itself as a step-by-step guide for creating an Exodus wallet, likely designed to deceive victims into downloading malicious software or entering sensitive credentials. Such tactics are commonly associated with crypto drainers or fake login portals, where attackers harvest private keys, recovery phrases, or other authentication details to gain unauthorized access to digital assets. The inclusion of "Exodus" in the domain name and page title suggests a deliberate attempt to exploit the trust and recognition of the legitimate Exodus brand, increasing the likelihood of successful social engineering attacks against unsuspecting users. Analysis of the domain reveals multiple technical indicators supporting its malicious classification. The domain is flagged by 22 out of 95 security vendors on VirusTotal, indicating a consensus among cybersecurity tools regarding its suspicious nature. It appears on one security blocklist and is currently blocked by at least one threat intelligence feed. Infrastructure analysis shows the domain resolves to the IP address 62.210.172.148, located in France under AS12876 (SCALEWAY S.A.S.). The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious sites due to its free and automated issuance process. The domain was registered through Squarespace Domains II LLC, a registrar frequently abused for hosting fraudulent content due to its accessibility and ease of use for threat actors. Users who visited wallett-exoduss-innus.wasmer.app or interacted with its content should take immediate remedial actions to mitigate potential risks. First, any credentials, recovery phrases, or private keys entered on the site must be considered compromised and should be revoked or transferred to a new, secure wallet immediately. Users are advised to scan their devices for malware using updated security tools, as the site may have distributed malicious payloads. Additionally, monitoring financial and cryptocurrency accounts for unauthorized transactions is critical. If the site prompted the download of any software, such files should be deleted without execution, and the device should undergo a full system scan. Finally, users should report the domain to relevant cybersecurity organizations or their wallet provider to contribute to broader threat intelligence efforts.