us-exosdeusweb[.]pages[.]dev

The domain us-exosdeusweb.pages.dev is currently active and hosts a page titled “Exodus Web3 Wallet® | Next‑Gen Crypto Experience”, indicating a deliberate attempt to masquerade as the Exodus cryptocurrency wallet brand. Infrastructure analysis shows the domain was registered on April 4 2026 through Cloudflare, Inc., and resolves to the Cloudflare‑owned address 188.114.97.3 located in Canada. DNS is served by beau.ns.cloudflare.com and cloe.ns.cloudflare.com, and the site presents a valid SSL certificate issued by Google Trust Services under the WE1 authority, which may lend an appearance of legitimacy. The Gridinsoft trust score of 0 / 100 and the fact that two of ninety‑four VirusTotal scanners flagged the domain suggest malicious intent, consistent with the identified “Seed Phrase Phishing” kit used for crypto credential harvesting. The site returns HTTP 200, is listed on one external blocklist, and is already blocked by PhishDestroy. While the page content beyond the title has not been examined, the combination of brand impersonation, a credential‑stealing kit, and low trust scores classifies the threat as high risk. Defenders should immediately block the domain and its resolving IP at network perimeter devices, add the host to internal URL filtering and threat‑intel feeds, and monitor outbound traffic for attempts to contact the IP. Users of the Exodus wallet should be reminded not to enter seed phrases on any site other than the official Exodus domain, and incident response teams should be prepared to investigate any reports of compromised seed phrases originating from this host.