walletexo-us[.]pages[.]dev

This domain, walletexo-us.pages.dev, presents a high-severity brand impersonation threat specifically targeting cryptocurrency wallet users. Analysis indicates the site mimics the official Exodus wallet interface, using the page title 'EXODUS® Web3 Wallet | Getting Started With Exódus®' to deceive visitors into believing they are accessing legitimate wallet onboarding procedures. The domain is designed to harvest sensitive credentials, recovery phrases, or private keys, enabling unauthorized access to digital assets stored in cryptocurrency wallets. The inclusion of Web3 terminology and the Exodus brand name increases the likelihood of successful social engineering against users familiar with decentralized finance platforms. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification of this domain. The domain was registered through Cloudflare, Inc. and resolves to the IP address 172.66.47.81. It employs an SSL certificate issued by Google Trust Services, which may lend an appearance of legitimacy to unsuspecting users. Detection metrics indicate significant security vendor consensus, with 13 out of 95 engines on VirusTotal flagging the domain as malicious. The domain appears on three distinct security blocklists and has been assigned a trust score of 0/100 by Gridinsoft. Additional technical observations include the use of HSTS, Cloudflare infrastructure, and HTTP/3, which are consistent with modern web hosting practices but do not mitigate the underlying fraudulent intent. The domain was created on January 14, 2026, suggesting recent deployment in active phishing campaigns. Users who have visited walletexo-us.pages.dev or interacted with its content should take immediate remediation steps to secure their assets. Any credentials, recovery phrases, or private keys entered on the site should be considered compromised and must be revoked or transferred to new, secure wallet addresses. Affected users are advised to conduct a thorough review of all connected wallet transactions for unauthorized activity. It is recommended to monitor associated accounts for signs of compromise and to update authentication credentials for any platforms where similar login information may have been reused. Security professionals should add the domain and its resolving IP address (172.66.47.81) to organizational blocklists to prevent further exposure within networked environments.