exdua-web[.]pages[.]dev

This domain, exdua-web.pages.dev, is flagged as a high-risk brand impersonation threat designed to mimic a widely recognized multi-chain cryptocurrency wallet interface. Analysis indicates the domain specifically targets users of the decentralized bridging protocol, presenting a fraudulent Web3 wallet login page titled 'Exodus Web3 Wallet | Secure Multi-Chain Crypto.' The infrastructure is engineered to harvest credentials or private keys, likely deploying a cryptocurrency drainer kit to siphon assets upon user interaction. Infrastructure analysis reveals the following technical indicators: the domain is registered through Cloudflare, Inc., and resolves to IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.). The domain was created on February 21, 2026, an anomalous future date suggesting registry manipulation or spoofing. Security vendor detections on VirusTotal report 17 out of 95 engines flagging the domain as malicious. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence feeds. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider often exploited to lend false credibility to phishing sites. The domain is currently offline, likely following takedown actions or automated enforcement by the hosting provider. Despite its inactive status, residual risk remains due to potential re-activation under a new domain or IP. Users who interacted with the site prior to takedown are advised to revoke active sessions, rotate private keys, and monitor connected wallets for unauthorized transactions. Organizations should update internal blocklists to include this domain and its associated indicators to prevent future exposure.