excoodislogin[.]webflow[.]io

excoodislogin.webflow.io is currently active and hosts a credential‑phishing page that masquerades as the Exodus cryptocurrency wallet login. The page title observed in the HTTP response is "Exodus login | Started with Exodus", indicating a direct brand impersonation. The site was registered through Webflow, a popular SaaS website builder, and resolves to the Cloudflare IP address 172.64.151.8 located in Canada. TLS termination is provided by Google Trust Services under the WE1 certificate, and the server returns HTTP 200 for the landing page. Threat intelligence feeds have listed the domain on three blocklists – PhishDestroy, MetaMask, and SEAL – confirming its malicious intent. VirusTotal analysis shows that 18 of 91 scanned security vendors flagged the domain, reinforcing the risk assessment. The primary uncertainty is the extent of credential harvesting infrastructure behind the front‑end; no further indicators such as command‑and‑control servers or malware payloads have been disclosed. Defenders should block the domain at network perimeter, update web‑filter and email security policies to deny any URLs containing "excoodislogin.webflow.io", and monitor for attempted credential submissions targeting Exodus users. Continuous re‑evaluation is advised, as the hosting provider can modify DNS records without notice.