exodusweb3-en-usa[.]pages[.]dev

This domain is classified as a high-risk brand impersonation threat, specifically targeting cryptocurrency wallet users through deceptive infrastructure. Analysis indicates the site mimics legitimate multi-chain wallet interfaces to harvest credentials or distribute malicious payloads, with a focus on the 'across' platform. The domain presents a significant risk due to its sophisticated impersonation tactics and broad detection by security mechanisms. Infrastructure analysis reveals the domain exodusweb3-en-usa.pages.dev was registered on February 21, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare’s CDN. VirusTotal detections show 20 out of 95 security vendors flagging the domain as malicious, while it appears on three distinct security blocklists. The page title, 'Exodus Web3 Wallet - Secure Multi-Chain Crypto Management,' directly impersonates a well-known wallet provider, increasing the likelihood of successful social engineering attacks. Mitigation requires immediate blocking of the domain and its associated IP (188.114.97.3) at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to domains registered under Cloudflare’s pages.dev service with recent creation dates and low trust scores. Users should be educated on verifying domain authenticity before entering credentials, particularly for crypto-related services. Security teams are advised to monitor for similar patterns, such as newly created domains with wallet-related keywords, SSL certificates issued by Google Trust Services, and hosting on Cloudflare’s infrastructure, as these indicators are frequently exploited in brand impersonation campaigns.