exodus-en-io[.]pages[.]dev

The domain exodus-en-io.pages.dev has been identified as a high-risk brand impersonation threat specifically targeting Exodus cryptocurrency wallet users. Analysis confirms this domain was actively impersonating the legitimate Exodus wallet platform, presenting itself under the page title 'Exodus Wallet — Simple, Secure & Beautiful.' The domain is currently offline, though prior activity indicates malicious intent to deceive users into interacting with fraudulent wallet interfaces. Infrastructure analysis reveals multiple concrete indicators of compromise. The domain was flagged by 17 of 95 security vendors on VirusTotal, indicating broad recognition of its malicious nature. It was registered on October 11, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335). The domain appears on three security blocklists and is actively blocked by multiple threat intelligence platforms. Its SSL certificate, issued by Google Trust Services (WE1), aligns with common patterns observed in transient phishing infrastructure. Current status confirms the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Security teams are advised to monitor for related domains using similar naming conventions or infrastructure patterns. Users should verify all wallet interactions through official Exodus channels only, avoid clicking on unsolicited links, and report any suspicious domains to their security providers for further analysis. Organizations should update blocklists to include this domain and its resolved IP to prevent potential re-emergence.