web3-exdus[.]zapier[.]app

This domain, web3-exdus.zapier.app, poses a targeted brand impersonation threat against Exodus, a widely used cryptocurrency wallet provider. The site presents itself as an official Exodus web3 wallet interface, likely designed to harvest user credentials, private keys, or seed phrases under false pretenses. Given the domain's hosting on a legitimate automation platform (zapier.app), it exploits trust in the parent domain to bypass initial user skepticism, a tactic increasingly observed in credential theft campaigns. Analysis indicates the domain was flagged by 17 out of 95 security vendors on VirusTotal, suggesting moderate detection coverage but persistent risk. It was registered through Name.com, Inc., and resolves to the IP address 64.239.109.129. Infrastructure analysis reveals the use of Amazon Web Services, Vercel, and Amazon S3 for hosting, alongside Stripe and reCAPTCHA integrations—common components in legitimate services that may lend credibility to the fraudulent site. The domain appears on one security blocklist and employs a Let's Encrypt SSL certificate, further mimicking secure, legitimate platforms. The page title explicitly reads 'Exodus web3 wallet,' reinforcing the impersonation attempt. Users who visited web3-exdus.zapier.app should assume potential exposure of sensitive wallet credentials. Immediate actions include revoking any connected sessions, rotating passwords or seed phrases, and monitoring associated accounts for unauthorized transactions. If cryptocurrency was transferred or private keys were entered, affected assets should be considered compromised. Users are advised to report the domain to relevant security teams and verify future wallet interactions exclusively through official Exodus channels. Given the domain's current offline status, further monitoring of related infrastructure is recommended to detect potential resurgence or similar impersonation attempts.