exodus-two[.]pages[.]dev

PhishDestroy identifies exodus-two.pages.dev as an active crypto drainer impersonating the legitimate Exodus wallet software. This domain masquerades as an official Exodus service to trick users into connecting wallets and authorizing malicious transactions. At the time of detection, the page remains unblocked by security vendors, with a current VirusTotal score of 0/95 detections, indicating no antivirus or browser defenses are flagging the page. This behavior aligns with known tactics used by crypto drainers to exploit user trust and automate fund theft under the guise of a trusted brand. This domain was flagged through domain behavioral analysis and reputation scoring, showing clear indicators of impersonation and high-risk activity. It resolves to IP 188.114.96.3 via Cloudflare, Inc., a provider often abused to rapidly deploy malicious infrastructure. The domain uses a valid Let’s Encrypt SSL certificate to appear legitimate, increasing the likelihood of user deception. As of now, VirusTotal reports 0/95 detections, suggesting it has not yet been widely recognized as malicious by endpoint security tools. No public blocklists currently include this domain, and trust scores from domain intelligence platforms remain unverified due to its recent activation. To mitigate risk, users should never interact with unsolicited links claiming to be Exodus or any wallet service. Always verify domain origins directly from official channels (e.g., exodus.com) and use browser extensions like PhishDestroy to check domain reputation in real time. If connected accidentally, revoke any wallet permissions immediately via the official wallet application and transfer remaining funds to a new, secure wallet. Report the domain to PhishDestroy and relevant abuse teams (e.g., Cloudflare) to aid in takedown efforts and prevent further exploitation.