connect-exxods-en[.]pages[.]dev

This domain, connect-exxods-en.pages.dev, is an active phishing site designed to impersonate Exodus, a legitimate cryptocurrency wallet provider. The site displays a fraudulent login interface mimicking the official Exodus Wallet, with the page title 'Exodus Wallet | Secure Cryptocurrency Wallet for Desktop & Mobile.' Users who enter credentials or recovery phrases on this site risk unauthorized access to their cryptocurrency holdings, leading to potential financial theft. The site may also distribute malware under the guise of wallet software updates or security tools. Analysis indicates this domain was registered on April 30, 2026, through Cloudflare, Inc., a provider frequently leveraged by threat actors to obscure infrastructure details. The domain resolves to the IP address 172.66.44.77, geolocated to Cloudflare’s network in Canada. As of the latest scan, 2 out of 95 security vendors on VirusTotal have flagged this domain as malicious, while one security blocklist has added it to their denylist. The SSL certificate, issued by Google Trust Services (WE1), further masks the site’s true origin, making it appear legitimate to unsuspecting users. If you have visited connect-exxods-en.pages.dev or entered any sensitive information, immediate action is required. Disconnect the device from the internet to prevent further data exfiltration. Do not interact with any prompts or download any files from the site. Reset all passwords and recovery phrases associated with your Exodus Wallet or other cryptocurrency accounts using a secure, trusted device. Monitor your wallet transactions for unauthorized activity and consider revoking access to any connected applications. Report the incident to the official Exodus support team and relevant cybersecurity authorities to assist in tracking and mitigating the threat.