download[.]exodus[.]build

This domain, download.exodus.build, is confirmed to engage in brand impersonation targeting Exodus, a widely used cryptocurrency wallet provider. Analysis indicates the site was designed to mimic the legitimate Exodus Web3 wallet interface, likely to distribute malicious software or harvest sensitive credentials such as wallet recovery phrases, private keys, or other authentication details. The domain’s infrastructure and content suggest a focus on cryptocurrency users, a common target for credential theft and crypto drainer attacks due to the irreversible nature of blockchain transactions. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on August 31, 2025, through Name.com, Inc., and currently resolves to the IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335). Despite its recent creation, the domain has been flagged by 17 out of 95 security vendors on VirusTotal, and it appears on at least one security blocklist. Notably, the site lacks an SSL certificate, a red flag for any platform handling sensitive financial or authentication data. The page title, Web3 Wallet, further reinforces its attempt to deceive users into believing it is a legitimate Exodus service. Users who visited download.exodus.build should take immediate action to mitigate potential risks. If any credentials, recovery phrases, or private keys were entered on the site, affected wallets should be considered compromised and funds transferred to a new, secure wallet immediately. Devices used to access the domain should undergo a full malware scan using updated security tools to detect any downloaded payloads. Additionally, users are advised to monitor their cryptocurrency transactions for unauthorized activity and enable multi-factor authentication on all related accounts. Given the domain’s offline status, further analysis may be limited, but vigilance is critical to prevent secondary infections or follow-up attacks.