exdus-web3-start[.]square[.]site

Analysis of exdus-web3-start.square.site shows an active infrastructure that impersonates the Exodus brand. The domain was registered on February 21, 2026 through MarkMonitor, Inc. and resolves to IP 74.115.51.5, which belongs to AS27647 Weebly, Inc. in the United States. The site serves content over HTTPS using a Let’s Encrypt/E7 certificate and returns HTTP 200. Technical fingerprints reveal the use of Weebly hosting, MySQL, PHP, Vue.js and Cloudflare services. The page title “Exodus Web3 Wallet | Secure Crypto” aligns with the declared brand target Exodus and the listed scam type “Crypto Scam”. Reputation data indicate a trust score of 0/100 from Gridinsoft, placement on three security blocklists, and active blocking by PhishDestroy, MetaMask and SEAL. VirusTotal scans show 14 of 95 security vendors flagging the domain. The combination of brand impersonation, low trust score, blocklist presence, and vendor detections supports a high‑risk assessment. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as no page content has been examined. Defenders should add the domain to deny‑list rules, monitor DNS queries for the associated nameservers, and consider sinkholing the IP address. User education should emphasize that any request to “Exodus Web3 Wallet” originating from this domain is malicious and should be ignored.