exodus-web--3[.]pages[.]dev

This domain, exodus-web--3.pages.dev, is flagged as a high-risk brand impersonation resource targeting Exodus, a cryptocurrency wallet provider. Analysis indicates the page mimics official Exodus documentation, presenting itself under the title 'Exodus Web 3 Wallet — Guide, Features & FAQs.' The domain does not appear to utilize a known drainer kit but employs social engineering tactics to deceive users into divulging sensitive credentials or wallet access details. The infrastructure and content are designed to closely resemble legitimate Exodus resources, increasing the likelihood of successful victim compromise. Infrastructure analysis reveals the domain was registered on March 01, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.44.159, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious domains leveraging Cloudflare’s infrastructure. Detection metrics indicate the domain is flagged by 4 out of 95 security vendors on VirusTotal, while three independent security blocklists—PhishDestroy, MetaMask, and SEAL—have classified it as malicious. No Google Safe Browsing (GSB) detection is currently recorded, though this may reflect a lag in propagation rather than an absence of risk. The domain remains active as of the latest verification, posing an ongoing threat to users. Response actions by security blocklists have mitigated some exposure, but the resource continues to resolve and may evade detection in environments lacking updated threat intelligence. The risk level is assessed as high due to the combination of brand impersonation, low detection rates among some vendors, and the use of Cloudflare’s infrastructure, which can obscure origin analysis. Users and organizations are advised to block the domain at the network level, update endpoint protection rules, and conduct retrospective analysis for any prior interactions with the resource. Enhanced monitoring of cryptocurrency-related phishing domains is recommended, particularly those leveraging Cloudflare Pages for hosting.