# app-exodues.pages.dev — MALICIOUS

> Exodues imposter site app-exodues.pages.dev is a phishing page hosted on Cloudflare that steals user credentials.

## Summary
PhishDestroy identifies app-exodues.pages.dev as an active credential-harvesting page designed to mimic the legitimate Exodus crypto wallet login portal. Visitors are presented with a nearly identical interface that captures entered email addresses and wallet passwords, which are then exfiltrated to attacker-controlled servers. Because the domain leverages Cloudflare Pages to bypass traditional hosting-blocklists and uses a Google Trust Services certificate to appear legitimate, inexperienced users are especially likely to be deceived into submitting sensitive wallet credentials. Intelligence shows the page has already been flagged by nine VirusTotal partners, indicating widespread recognition of its malicious nature, but it remains accessible and continues to harvest data for financial gain.  This domain was flagged with an elevated risk rating after technical analysis confirmed its association with generic phishing operations. Key indicators include registration through Cloudflare, Inc., TLS issuance by Google Trust Services, and resolution to IP address 188.114.97.3. Among VirusTotal scanners, exactly nine out of ninety-five security vendors have already detected malicious payloads or phishing content on the page, demonstrating early-stage but accelerating recognition of the threat. The combination of free Cloudflare Pages hosting, a reputable SSL certificate, and low historical detection rates makes this domain a persistent danger to cryptocurrency users seeking to access their wallets.  If you visited app-exodues.pages.dev, immediately assume your Exodus credentials and any associated seed phrases have been compromised. Rotate your wallet password using the official Exodus application or website and enable two-factor authentication. Revoke any session tokens linked to the exposed account by visiting My Account > Security Settings within the legitimate Exodus app. After securing your wallet, scan all connected devices with up-to-date antivirus software to detect any accompanying malware. Finally, report the incident URL to your organization’s security team or to the official Exodus phishing reporting portal to aid collective defense.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 9 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/6ff2d4c0-b7e6-4c7b-8813-6f4cdcddf696
- PhishDestroy: https://phishdestroy.io/domain/app-exodues.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/app-exodues.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/app-exodues.pages.dev/
Last updated: 2026-03-22