exodua-web3-wallet-auth[.]tem3[.]io

This domain, exodua-web3-wallet-auth.tem3.io, is identified as a high-risk credential harvesting operation targeting users of the Exodus cryptocurrency wallet. Analysis indicates the threat type is brand impersonation, specifically designed to mimic the legitimate Exodus Web3 Wallet interface. As of the latest assessment, the domain has been taken offline, though prior activity suggests it was actively used to deceive victims into disclosing sensitive authentication details. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on August 02, 2024, and resolves to the IP address 188.114.96.3. Security vendors have flagged this domain as malicious, with 16 of 95 VirusTotal vendors marking it as a threat. The domain appears on three distinct security blocklists and is explicitly blocked by multiple security frameworks, including MetaMask and SEAL. The page title, 'Unlock the Decentralized Web with Exodus Web3 Wallet,' directly mirrors legitimate branding to enhance deception. The SSL certificate, issued by Google Trust Services, further complicates detection by end-users due to its apparent legitimacy. Current status confirms the domain is offline, reducing immediate risk to potential victims. However, the infrastructure remains a concern due to the domain's recent creation and association with known malicious indicators. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Users who may have interacted with this domain should immediately revoke any active sessions, reset credentials, and monitor accounts for unauthorized activity. Security teams are encouraged to review logs for connections to 188.114.96.3 and the domain itself, as these serve as concrete indicators of compromise.