home-eoxdus--web[.]pages[.]dev

The domain home-eoxdus--web.pages.dev has been identified as a threat due to brand impersonation, specifically targeting the Exodus brand. This domain was designed to mimic legitimate branding associated with Exodus, potentially misleading users into divulging sensitive information. The page title, 'Exodus Web 3 Wallet® | Getting started with Exodus Web,' suggests an attempt to impersonate the official Exodus Web 3 Wallet, increasing the risk of phishing attacks aimed at users seeking legitimate financial services.

Technical analysis reveals that the domain was registered through Cloudflare, Inc., and its IP address resolves to 172.66.44.190. The security certificate is issued by Google Trust Services. Despite its misleading appearance, the domain has a VirusTotal detection score of 0/95, indicating no current flags by the service. However, the domain has been blocked by multiple security services including MetaMask, PhishDestroy, and SEAL, and appears on three different security blocklists. The domain was created on April 25, 2026, and has a Gridinsoft trust score of 0/100, reflecting a lack of trustworthiness. The use of technologies like HSTS, Cloudflare, and HTTP/3 was detected, which could indicate attempts to establish a secure and convincing facade.

As of now, the domain has been taken offline, mitigating immediate threats posed to users. However, the fact that it was able to operate without detection on VirusTotal suggests potential gaps in early threat identification systems. Security professionals should continue monitoring for similar domains and educate users on recognizing phishing attempts. Users should also ensure their antivirus software and phishing filters are up-to-date to prevent exposure to similar threats. The domain's offline status reduces immediate risk, yet vigilance remains essential to safeguard against future impersonation attacks.