web3-en-exdosweb-us[.]pages[.]dev

PhishDestroy identifies an active brand impersonation campaign targeting Exodus users through the domain web3-en-exdosweb-us.pages.dev. This campaign masquerades as Exodus’ official Web3 wallet content to harvest credentials and seed phrases from cryptocurrency holders. The risk level is currently classified as under investigation due to incomplete behavioral telemetry, but the domain presents an immediate threat to end-users engaging with Web3 platforms.

This domain resolves to IP 188.114.97.3 via Cloudflare, Inc., leveraging Google Trust Services for SSL encryption. VirusTotal currently shows 0 detections out of 95 scanners, indicating low antivirus coverage despite clear impersonation signals. The page title—Exodus Web3 Wallet: The Comprehensive Guide to Digital Sovereignty—mirrors official Exodus communication. This domain is already blocked by MetaMask and SEAL security systems and appears on 2 known threat blocklists, though it remains operationally active.

Mitigation for users requires immediate avoidance of links from this domain and any associated web content. Validate all crypto wallet interfaces by checking the official domain exodus.com and confirming HTTPS with a valid certificate issued to Exodus Movement, Inc. Enable phishing protection in MetaMask and browser extensions like SEAL. Report any interaction with this domain to the official Exodus security team via their verified support channels and submit indicators to PhishDestroy for further threat intelligence dissemination.