home-exada-webdocs[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat designed to deceive users of a well-known cryptocurrency wallet service. Analysis indicates the site mimics the legitimate platform’s interface, presenting itself as a Web 3 wallet with the page title "Exodus Web 3 Wallet® | Getting Started." The intent is to trick users into entering sensitive credentials or interacting with malicious smart contracts, potentially leading to unauthorized asset transfers or account compromise. Infrastructure analysis reveals multiple concerning indicators. The domain, created on February 28, 2026, is registered through Cloudflare, Inc., and resolves to the IP address 172.66.47.45. Security vendors on VirusTotal have flagged the domain as malicious, with 13 out of 95 engines detecting it. The site appears on three security blocklists and is actively blocked by wallet protection systems and phishing detection tools. Additional technical details include the use of Cloudflare’s infrastructure, HSTS enforcement, and HTTP/3 protocol, alongside a Google Trust Services SSL certificate. A trust score of 0/100 further underscores its high-risk classification. Mitigation steps for this specific threat type include immediate blocking of the domain and associated IP address within network security controls. Users who may have interacted with the site should revoke any connected wallet permissions, rotate credentials, and scan devices for malware. Organizations should update phishing detection rules to include this domain and its infrastructure indicators, such as the Cloudflare-hosted subdomain pattern and the resolving IP. Security teams are advised to monitor for similar impersonation domains leveraging the same registrar or hosting provider, as this may indicate a broader campaign targeting cryptocurrency users.