doc-exodusweb3-web-access[.]tem3[.]io

PhishDestroy identifies doc-exodusweb3-web-access.tem3.io as an active crypto drainer impersonating the Exodus wallet brand. The domain leverages typosquatting (doc-exodusweb3-web-access) to deceive users into connecting wallets and authorizing malicious transactions. This threat specifically targets cryptocurrency users under the guise of a legitimate Exodus Web3 access portal, aiming to drain funds via deceptive transaction approvals.

This domain was flagged with 0 detections out of 95 VirusTotal engines, registered through GoDaddy.com, LLC on August 02, 2024, and resolves to IP 188.114.96.3. It holds a valid SSL certificate from Google Trust Services but is blocked by MetaMask and appears on 1 security blocklist. The domain’s age (newly registered) and lack of detection suggest it may be part of an emerging campaign. The combination of a trusted SSL issuer, recent registration, and blocklist presence indicates a sophisticated but still-evolving threat.

To mitigate risk, users should avoid interacting with this domain entirely. Before connecting a wallet or entering credentials, verify the domain’s legitimacy through PhishDestroy’s threat database or official Exodus channels. If exposed, revoke any unauthorized wallet permissions via tools like Etherscan’s token approvals or your wallet’s built-in security features. Report the domain to MetaMask and Exodus for further takedown actions.