enusexe-dos[.]pages[.]dev

This domain, enusexe-dos.pages.dev, is actively impersonating Exodus, a cryptocurrency wallet provider, as indicated by the page title 'Exodus Web3 Wallet | Exodus® Browser Extension — Presentation' and confirmed brand target data. Registered on April 30, 2026, through Cloudflare, the domain resolves to IP 172.66.47.122 and employs Cloudflare infrastructure, including HSTS and HTTP/3. The SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious domains leveraging Cloudflare's services. Analysis reveals the domain is flagged by at least three security blocklists and is explicitly blocked by SEAL, MetaMask, and PhishDestroy, suggesting recognition as a phishing threat within the security community. VirusTotal reports 13 of 95 security vendors detecting this domain as malicious, though the absence of additional context limits interpretation of specific detection logic. The Gridinsoft trust score of 0/100 further supports its classification as high-risk. No evidence currently links this domain to a known phishing kit or campaign beyond the Exodus brand impersonation. Defenders should treat this domain as part of an active phishing operation targeting cryptocurrency users, particularly those familiar with Exodus's browser extension. Immediate blocking at the DNS or network level is recommended, alongside monitoring for associated IOCs such as the resolving IP and SSL certificate details. Further analysis of the site's content and backend infrastructure may reveal additional indicators, but current evidence is sufficient to classify this as a high-risk brand impersonation threat.