official-exodus-walet[.]framer[.]ai

The domain official-exodus-walet.framer.ai was registered through CSC Corporate Domains, Inc. on April 04, 2023. It resolves to the Amazon Web Services address 52.223.52.2, which belongs to ASN 16509 operated by Amazon.com, Inc. and is geolocated in the United States. The authoritative name servers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns, confirming the use of AWS Route 53 DNS hosting. The site served a TLS certificate issued by Let’s Encrypt (certificate identifier E8), enforcing HSTS and supporting HTTP/3, and was built with Framer Sites and React.

The page title reported by the scanner is “Getting started with Exodus Web3 Wallet”, indicating an attempt to impersonate the Exodus cryptocurrency wallet brand. Classification from the intelligence feed labels the activity as a “Crypto Scam”. VirusTotal recorded 15 detections out of 93 scanning engines, and the domain appears on one security blocklist. PhishDestroy has already blocked the domain, and the current HTTP response is 404, with the overall status marked as offline.

No additional public analysis of the page content is available, and the exact phishing kit or credential‑harvesting mechanisms have not been observed. Defenders should add the domain and its resolved IP address to blocklists, update URL filtering rules for the “exodus” keyword, and monitor for other Framer‑based deployments that use similar naming patterns. Continued observation of the associated AWS ASN for new domains created with comparable timestamps is advisable, as the infrastructure suggests a reusable hosting profile. Because the site is currently offline, rapid takedown is less critical, but the evidence indicates a broader campaign targeting cryptocurrency users, and proactive measures can reduce exposure to future iterations.