sso-exdus-wallet[.]square[.]site

This domain, sso-exdus-wallet.square.site, is flagged as a high-risk brand impersonation threat targeting Exodus, a widely recognized multi-asset cryptocurrency wallet provider. Analysis indicates the site mimics the official Exodus branding, including the use of trademarked terms such as 'Official Site' and 'Exodus Web3 Wallet' in its page title. The domain appears designed to deceive users into believing they are interacting with a legitimate Exodus platform, potentially facilitating unauthorized access to cryptocurrency assets or sensitive user credentials. No direct evidence of a crypto drainer kit was identified, but the infrastructure aligns with known tactics used in cryptocurrency-related fraud campaigns. Infrastructure analysis reveals several critical technical indicators. The domain resolves to the IP address 74.115.51.5, hosted under AS27647 (Weebly, Inc.), a provider frequently exploited for impersonation schemes. It was registered through MarkMonitor, Inc. on February 21, 2026, though this date may reflect spoofed or manipulated registration data. The domain is flagged by 13 out of 95 security vendors on VirusTotal, indicating moderate to high detection rates across threat intelligence platforms. Additionally, it appears on three security blocklists and is actively blocked by multiple browser-based security extensions. The SSL certificate, issued by Let's Encrypt (serial number E7), does not mitigate the risk, as fraudulent domains commonly leverage free certificates to appear legitimate. As of the latest assessment, the domain has been taken offline, reducing immediate exposure to end users. However, the underlying infrastructure remains a residual risk, as threat actors may re-deploy similar domains or shift hosting providers to evade detection. Response actions by security vendors, including takedown efforts and blocklist updates, have mitigated active threats, but users are advised to verify domain authenticity before interacting with any cryptocurrency-related services. Organizations should monitor for recurring impersonation attempts targeting Exodus or other crypto wallets, particularly those hosted on shared or low-reputation infrastructure. Proactive measures, such as domain monitoring and user education on brand spoofing tactics, are recommended to prevent future incidents.