exdous[.]framer[.]ai

On July 23, 2026 analysts observed that the domain exdous.framer.ai is hosting a brand‑impersonation site that claims to represent the Exodus Web3 Wallet. The site’s HTML title reads “Exodus Web3 Wallet – Your Gateway to Web3 & DeFi™”, matching the advertised brand and reinforcing the deception. Domain registration occurred on February 21, 2026 through CSC Corporate Domains, Inc., and the authoritative nameservers are ns-1902.awsdns-45.co.uk, ns-635.awsdns-15.net, ns-1198.awsdns-21.org, indicating reliance on Amazon Route 53 DNS services. Technical fingerprints show the site was built with Framer Sites and React, and it employed HTTP/3 and HSTS, while the TLS certificate was issued by Let’s Encrypt (E8).

The domain resolves to IP address 35.71.142.77, an Amazon.com, Inc. host in the United States (AS16509). HTTP probing returned a 404 status, and the domain has since been taken offline, consistent with the reported “offline” status. VirusTotal scans recorded 12 detections out of 93 security vendors, and the domain appears on three public blocklists, specifically PhishDestroy, MetaMask, and SEAL. The activity is classified as a crypto‑related scam targeting users of the Exodus wallet.

While the page content itself has not been captured, the combination of brand‑specific title, matching technology stack, and the presence on cryptocurrency‑focused blocklists strongly suggests a credential‑harvesting or fund‑diversion campaign. Defenders should continue to block the domain at network perimeters, monitor for any residual traffic to the associated IP range, and update endpoint and browser security solutions with the identified blocklist entries. Additionally, security teams should alert Exodus Wallet users about the fraudulent domain and advise them to verify URLs before entering any wallet credentials.