exd-us-web3[.]pages[.]dev

This domain is flagged for brand impersonation, specifically targeting Exodus cryptocurrency wallet users. Analysis indicates the infrastructure was designed to mimic legitimate Exodus Web3 wallet onboarding materials, as evidenced by the page title 'Exodus Web3 Wallet | Getting Started Guide.' The threat type aligns with credential harvesting or crypto drainer deployment, though no malicious payloads have been confirmed in initial scans. Infrastructure analysis reveals the domain exd-us-web3.pages.dev was registered on April 23, 2026, through Cloudflare, Inc. and currently resolves to IP address 188.114.96.3. Despite zero detections in VirusTotal (0/95), the domain appears on three security blocklists and is actively blocked by wallet security providers. The SSL certificate is issued by Google Trust Services, and the site employs HSTS, Cloudflare CDN, and HTTP/3 protocols. Gridinsoft trust score is 0/100, indicating high-risk classification. The domain was taken offline following detection, though historical snapshots confirm its operational state during the investigation window. Mitigation requires immediate action from cryptocurrency users who may have interacted with the domain. Those who visited the site should revoke any connected wallet permissions and transfer assets to new, verified wallet addresses. Security teams should monitor for similar Cloudflare Pages subdomains using the 'exd-us' prefix pattern, as this may indicate related infrastructure. Network defenders should implement DNS-based blocking for 188.114.96.3 and associated Cloudflare IP ranges. Exodus users should verify all communications through official channels and enable hardware-based authentication for wallet access.