en-us-exxedos[.]pages[.]dev

The domain en-us-exxedos.pages.dev is a confirmed phishing site engaged in brand impersonation targeting Ethereum users. It presents itself as an 'Exodus Web3 Wallet' browser extension to deceive victims into entering seed phrases or private keys, enabling unauthorized access to cryptocurrency wallets. No drainer kit was identified, but the site operates as a seed-phishing scam. As of analysis, en-us-exxedos.pages.dev has been taken offline.

Technical indicators confirm the malicious nature of en-us-exxedos.pages.dev. The domain, registered through Cloudflare, Inc. on March 02, 2026, resolves to the IP address 172.66.47.122 (US, AS13335 Cloudflare, Inc.). It is flagged by 2 of 95 VirusTotal security vendors, including ChainPatrol and alphaMountain.ai, and appears on 3 security blocklists: PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Google Trust Services (WE1), and the observed page title was 'Exodus Web3 Wallet | Exodus® Browser Extension — Presentation'. Technologies detected include HSTS, Cloudflare, and HTTP/3, with a current HTTP status of 403. Gridinsoft assigns a trust score of 0/100.

Victims of en-us-exxedos.pages.dev should immediately revoke any token approvals granted to unknown contracts and transfer funds to a new, secure wallet. If seed phrases or private keys were exposed, consider all associated wallets compromised. Report the domain to the impersonated brand (Ethereum/Exodus) and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group. Enable two-factor authentication on all accounts and monitor for unauthorized transactions or login attempts.