faqe-exodusd-com[.]typedream[.]app

faqe-exodusd-com.typedream.app was observed hosting a brand‑impersonation campaign targeting users of the Exodus cryptocurrency wallet. The site was provisioned through the Typedream website‑builder platform, which issues SSL certificates from Google Trust Services under the WE1 profile. Network analysis shows the domain resolved to the Cloudflare‑owned address 188.114.96.3, a location attributed to Canada. HTTP requests returned a 500 Internal Server Error, and the page title reflected the same error message, indicating that the malicious front‑end is no longer serving content.

VirusTotal scans recorded detections by 2 of 91 security vendors, and the domain appears on three independent blocklists, including PhishDestroy, MetaMask, and SEAL. The infrastructure was also flagged by brand‑specific protection services for impersonating Exodus. Nameserver data could not be retrieved (NS_NOT_FOUND). The domain has been taken offline at the time of reporting, but historical activity suggests that the attacker leveraged the Typedream hosting environment to quickly spin up a credential‑harvesting page that mimicked Exodus branding.

At present no active phishing page can be captured, so the exact content and credential‑capture mechanisms remain unknown. Defenders should continue to block the IP address 188.114.96.3, add the fully qualified domain to endpoint and web‑gateway blocklists, and monitor other Typedream‑generated subdomains for similar patterns. Because the site currently returns a server error, active probing is unlikely to yield additional payloads, yet threat‑intel feeds should be updated to reflect the confirmed brand‑impersonation status and the presence of the domain on existing blocklists. Ongoing vigilance is recommended to detect re‑registration attempts or derivative domains that reuse the same hosting provider or SSL profile.