web3exodus-hub-eng[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting Exodus, a cryptocurrency wallet provider. The site mimics the official Exodus Web3 Wallet interface, using the page title 'Exodus Web3 Wallet® — Secure, User-Friendly & Multi-Chain Wallet' to deceive users into entering sensitive credentials, such as private keys or recovery phrases. Analysis indicates this is a credential harvesting operation designed to compromise cryptocurrency assets. Infrastructure analysis reveals the domain web3exodus-hub-eng.pages.dev was registered through Cloudflare, Inc., and resolves to the IP address 172.66.44.246, located in the US under AS13335. The domain was created on March 01, 2026, and remains active despite being detected by 10 out of 95 security vendors on VirusTotal. It appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Google Trust Services (WE1), adding a layer of legitimacy to the malicious site. Mitigation steps for this threat include immediate blocking of the domain and its associated IP address (172.66.44.246) at the network level. Organizations should update security blocklists to include this domain and monitor for any attempts to access it. Users should be educated on verifying official domains and avoiding interaction with unsolicited wallet-related sites. Multi-factor authentication and hardware-based key storage should be enforced for cryptocurrency transactions to reduce the risk of credential theft. If credentials have been exposed, users must transfer assets to a new wallet and revoke access from the compromised one.