xodus-en[.]framer[.]ai

This report details a domain impersonating Exodus Wallet. The page title, "Getting started | Exodus Knowledge Base," indicates the site fraudulently presented itself as official help documentation for the Exodus cryptocurrency wallet. The threat posed is that of a phishing or credential-harvesting attack, where visitors believing they are accessing legitimate support could be tricked into revealing sensitive wallet information or private keys.

Technical analysis confirms the malicious nature of the domain. VirusTotal detected the site as malicious by 18 out of 95 scanning vendors. The domain was registered through CSC Corporate Domains, Inc., and was created on February 21, 2026. It was hosted on IP address 35.71.142.77, located in the United States and assigned to AS16509 Amazon.com, Inc. The site uses an SSL certificate issued by Let's Encrypt (serial E8). The domain is currently flagged on 3 separate blocklists.

The domain xodus-en.framer.ai is currently offline and no longer resolving. The risk posed during its active period was high, given the combination of a high detection rate on VirusTotal, recent registration, and impersonation of a well-known cryptocurrency wallet brand. Users who may have interacted with this domain should consider their credentials or wallet information potentially compromised.