io-exod-as-app[.]pages[.]dev

This domain is flagged for high-risk brand impersonation targeting Exodus, a widely used cryptocurrency wallet platform. Analysis indicates the infrastructure is designed to deceive users into believing they are interacting with official Exodus resources, potentially leading to credential theft, unauthorized transactions, or installation of malicious software. The page title, 'Exodus Wallet® Guide | Track, Send & Receive Cryptocurrency,' reinforces the false legitimacy by mimicking educational or support content associated with the legitimate brand. Infrastructure analysis reveals the domain was registered on April 27, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, located in California. The SSL certificate is issued by Google Trust Services (WE1), which may contribute to an appearance of authenticity. However, the domain appears on one security blocklist and is flagged by 10 out of 95 security vendors on VirusTotal, indicating a confirmed malicious classification. The combination of recent registration, brand-aligned naming, and low detection prevalence suggests a targeted or emerging threat. Users who have visited io-exod-as-app.pages.dev or interacted with its content should immediately revoke any permissions granted to associated applications, reset credentials for cryptocurrency wallets or exchange accounts, and scan their systems for unauthorized software. All transactions originating from or directed to this domain should be considered compromised. Monitoring for unusual activity on linked accounts is strongly advised, and any suspicious files downloaded from the domain should be treated as malicious payloads. Reporting the domain to relevant security teams and financial institutions can aid in mitigating further exposure.