# exodus-user-web.pages.dev — MALICIOUS

> exodus-user-web.pages.dev is a live crypto drainer phishing page flagged by 17 of 95 VirusTotal vendors. Act now to block this active threat.

## Summary
PhishDestroy identifies exodus-user-web.pages.dev as an active cryptocurrency drainer phishing page impersonating Exodus Wallet. The domain is currently live and distributing malicious payloads to users seeking wallet access.

This domain was flagged by 17 of 95 VirusTotal security vendors and registered through Cloudflare, Inc. It resolves to IP address 188.114.97.3 and is protected by a Google Trust Services SSL certificate. The page is hosted on Google's Pages.dev platform and has been added to Google Safe Browsing's SOCIAL_ENGINEERING blacklist.

Users should immediately block this domain and avoid any interaction. Exodus Wallet users are advised to verify all download links through official channels. Network administrators should implement firewall rules to block traffic to 188.114.97.3 and flag any DNS requests for exodus-user-web.pages.dev.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 17 vendors flagged
- Google Safe Browsing: FLAGGED
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/622a18fe-cfab-42fa-9d1a-139cb02d20c6
- PhishDestroy: https://phishdestroy.io/domain/exodus-user-web.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/exodus-user-web.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/exodus-user-web.pages.dev/
Last updated: 2026-03-22