xo--des-protect-web[.]pages[.]dev

This report details a domain identified as an impersonation threat. The site, titled "Exodus Web3 Wallet ® | Secure, Smart & Decentralized Crypto Experience ™," is a fraudulent clone designed to mimic the legitimate Exodus Web3 Wallet brand. The threat posed is credential theft or cryptocurrency asset compromise, as the site likely collects user login details or private keys under the pretense of a legitimate wallet service.

Technical evidence confirms the malicious nature of this site. VirusTotal analysis shows 4 out of 95 vendors flagged the domain as malicious, with detection by ChainPatrol, Kaspersky, Phishing Database, and Trustwave. The domain is registered via Cloudflare, Inc., and hosted on IP address 172.66.47.128 (United States, AS13335 Cloudflare). It was created on March 1, 2026, and uses an SSL certificate issued by Google Trust Services (WE1). The domain has a DOM risk score of 68, GridinSoft trust rating of 0/100, and ScamAdviser trust rating of 1/100, indicating high risk.

Currently, the domain is down or offline, limiting its immediate threat. However, the risk level is high due to the impersonation of a well-known crypto wallet brand, the low trust ratings, and the presence on three blocklists. Users should be aware that this site is fraudulent and avoid any interaction if it becomes active again.