exodus-wallet-aap[.]framer[.]media

Analysis of exodus-wallet-aap.framer.media confirms it as a high-risk crypto scam domain actively impersonating Exodus Wallet. The domain was registered on February 21, 2026, through CSC Corporate Domains, Inc., and hosted on Amazon Web Services (AS16509) with an IP address of 52.223.52.2, located in the United States. The page title, 'EXODUS® Web3 Wallet® | Getting Started Exodus™,' explicitly mimics the branding of Exodus Wallet, a well-known cryptocurrency wallet provider, aligning with the classified scam type of crypto fraud. Infrastructure analysis reveals the use of Framer Sites and React, alongside security features such as HSTS and HTTP/3, which may be leveraged to lend an appearance of legitimacy. The domain is currently offline, returning an HTTP 404 status, and has been taken down following detection by multiple security vendors.

At the time of assessment, 15 of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on three security blocklists. Google Safe Browsing has also classified the domain under social engineering, further corroborating its fraudulent nature. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious domains. Nameservers associated with the domain include ns-97.awsdns-12.com, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, and an additional AWS-managed server, indicating reliance on cloud infrastructure typical of phishing campaigns.

The domain has been blocked by PhishDestroy, MetaMask, and SEAL, reflecting coordinated defensive actions by industry stakeholders. While the exact content of the site remains unanalyzed due to its offline status, the combination of brand impersonation, crypto scam classification, and detection by multiple security mechanisms provides sufficient evidence to classify this domain as malicious.