exodus--web3--uss[.]pages[.]dev

This domain, exodus--web3--uss.pages.dev, is flagged as a brand impersonation threat targeting Exodus, a multi-asset cryptocurrency wallet. The site mimics legitimate Exodus web interfaces to deceive users into entering sensitive wallet credentials or approving malicious transactions, likely functioning as a crypto drainer. Such infrastructure is designed to exfiltrate private keys, seed phrases, or authorize unauthorized transfers, resulting in direct financial loss for victims. Analysis indicates the domain was registered on March 10, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.118. Despite its recent creation, the domain has already been flagged on three security blocklists, including MetaMask and PhishDestroy. VirusTotal reports 0/95 detections, suggesting the threat is either newly deployed or employs evasion techniques to avoid automated detection. The SSL certificate is issued by Google Trust Services, and the site uses HSTS and HTTP/3 protocols, which are common in both legitimate and malicious infrastructure to appear credible. The page title, 'Suspected phishing site | Cloudflare,' further indicates prior identification by hosting providers, though the domain remained accessible until its recent takedown. Users who visited exodus--web3--uss.pages.dev should assume potential exposure of sensitive wallet information. Immediate actions include revoking all active wallet session approvals, transferring assets to a new wallet with a fresh seed phrase, and scanning the device for malware. If credentials or private keys were entered, the compromised wallet should be considered permanently at risk. Monitoring for unauthorized transactions and reporting the incident to relevant blockchain security teams is recommended. Given the domain's association with crypto drainer tactics, affected users should also review connected dApp permissions and transaction histories for anomalies.