wlt-exodus-web[.]pages[.]dev

The domain wlt-exodus-web.pages.dev was identified as a sophisticated brand impersonation threat specifically targeting Exodus cryptocurrency wallet users. This phishing site attempted to mimic Exodus’s official web interface to trick visitors into connecting their wallets or entering sensitive credentials, effectively operating as a crypto drainer that would siphon funds. The domain leveraged Cloudflare’s infrastructure to appear legitimate, but its malicious intent was clear from its deceptive design and security vendor flags.

Analysis from PhishDestroy revealed that VirusTotal flagged this domain with 2 out of 95 security vendors detecting malicious activity, indicating a low but meaningful detection rate. The domain was registered through Cloudflare, Inc. on February 26, 2026, and resolves to IP address 172.66.47.46. It currently appears on three security blocklists, and the SSL certificate was issued by Google Trust Services. Although the page now shows a Cloudflare “Suspected phishing site” warning, the site has been taken offline to prevent further harm.

Users who visited wlt-exodus-web.pages.dev should immediately revoke any permissions granted to the site, transfer remaining crypto assets to a new wallet, and run a security scan on their device. It is critical to avoid interacting with unsolicited links and always verify URLs through official Exodus channels. Monitoring accounts for unauthorized transactions in the coming weeks is also recommended.