exo-dus-web3[.]framer[.]media

On July 23, 2026, analysis of exo-dus-web3.framer.media indicates a high‑risk brand impersonation campaign targeting Exodus Wallet users. The domain was registered on February 21, 2026 through CSC Corporate Domains, Inc. and resolves to the Amazon Web Services address 35.71.142.77, located in the United States under ASN 16509 (Amazon.com, Inc.). The site presents a page title of "Exodus Web3 Wallet™ | Secure Crypto Management®", directly referencing the Exodus brand and suggesting a crypto‑wallet front‑end.

Technical fingerprinting reveals the use of Framer Sites and React, with HTTP/3 support and enforced HSTS, while the TLS certificate is issued by Let’s Encrypt (certificate identifier E7). An HTTP request returns a 404 status, and the domain is currently taken offline, yet historical evidence shows it was actively serving malicious content before removal. Detection data shows the domain appears on three security blocklists—PhishDestroy, MetaMask, and SEAL—and has been flagged by 13 of 93 VirusTotal scanners, reinforcing the malicious classification.

The campaign is identified as a crypto scam, specifically a fake Exodus Wallet portal designed to harvest credentials or funds. Defenders should add the domain to local deny lists, monitor for any re‑registration of the same name or similar subdomains, and enforce outbound filtering for connections to the associated AWS IP range. Continuous observation of the registrar CSC Corporate Domains, Inc. for new registrations resembling the pattern is advised, as well as updating intrusion detection signatures to capture the Framer Sites/React stack fingerprint associated with this threat.