exoduswallet-support[.]netlify[.]app

The domain exoduswallet-support.netlify.app has been identified as an active crypto drainer targeting users of the Exodus cryptocurrency wallet. Infrastructure analysis shows the domain is served under the Netlify app sub‑domain space, a platform commonly used for static site hosting. The site is currently blocked by the PhishDestroy and OpenPhish feed providers and appears on two additional security blocklists, indicating that multiple independent threat intel sources have catalogued it as malicious.

VirusTotal scans have returned a detection rate of 11 out of 91 security vendors, confirming that a subset of anti‑malware engines flag the domain as harmful. No public page title, SSL certificate details, registrar information, or IP/ASN data were disclosed in the available intelligence, so an assessment of those attributes cannot be made at this time. The lack of such metadata limits visibility into the hosting provider’s exact IP range and certificate provenance, but the presence on established blocklists and the multi‑vendor VirusTotal detections provide sufficient evidence of hostile intent.

Defenders should immediately add exoduswallet-support.netlify.app to network deny lists, enforce URL filtering rules that block both HTTP and HTTPS requests to the domain, and monitor DNS queries for any attempts to resolve the host. End‑user awareness messaging should explicitly warn users that any unsolicited communication referencing Exodus wallet support that directs them to a netlify.app address is fraudulent. Continuous re‑evaluation is advised as additional investigative data, such as page content or certificate fingerprints, may become available, allowing for more granular mitigation measures.