io-exoduswebb[.]pages[.]dev

The domain io-exoduswebb.pages.dev has been confirmed as a brand impersonation site specifically targeting Exodus, a widely used cryptocurrency wallet platform. Analysis indicates this infrastructure was designed to deceive users into interacting with fraudulent wallet interfaces, likely facilitating unauthorized transactions or credential harvesting. The domain is currently offline, though its prior operational status poses residual risks to users who may have encountered it during its active period. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., resolving to the IP address 172.66.45.32, which is geolocated in the United States under AS13335 (Cloudflare, Inc.). The domain was created on February 21, 2026, and its SSL certificate is issued by Google Trust Services (WE1). Security vendors on VirusTotal flagged the domain as malicious, with 17 out of 95 vendors marking it as a threat. Additionally, the domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The page title, 'Exodus Web3 Wallet — Presentation,' further corroborates the intent to impersonate the legitimate Exodus platform. Current status indicates the domain has been taken offline, reducing immediate exposure risks. However, the infrastructure's prior use and the high-risk nature of the threat warrant continued vigilance. Organizations and individuals are advised to block the domain and associated IP address (172.66.45.32) at the network level. Users who may have interacted with this domain should immediately revoke any connected wallet permissions, monitor transaction histories for unauthorized activity, and reset credentials for associated accounts. Security teams should treat this domain as a confirmed malicious indicator and include it in threat intelligence feeds for proactive defense measures.