web3-exo-r-watt[.]pages[.]dev

This domain, web3-exo-r-watt.pages.dev, poses a high-risk brand impersonation threat targeting users of the Exodus Web3 Wallet. Analysis of the page title, 'Exodus© Web3 | Getting started® with Exodus Web3 Wallet,' indicates an attempt to deceive victims into believing they are interacting with legitimate Exodus infrastructure. The domain mimics the Across protocol, a known decentralized finance platform, likely to exploit trust in cross-chain transactions. Such impersonation campaigns typically aim to harvest cryptocurrency wallet credentials, seed phrases, or deploy malicious smart contracts to drain assets from unsuspecting users. Evidence supporting the malicious classification includes detection by 20 out of 95 security vendors on VirusTotal, as well as inclusion on three independent security blocklists. The domain was registered on September 12, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.44.101, hosted under AS13335 (Cloudflare, Inc.) in the United States. Additional indicators include prior blocking by multiple threat intelligence platforms, confirming its association with active phishing operations. The rapid takedown suggests intervention by the registrar or hosting provider following abuse reports. Users who visited web3-exo-r-watt.pages.dev should immediately revoke any connected wallet permissions and cease all interactions with the domain. If credentials or seed phrases were entered, the affected wallet should be considered compromised, and funds transferred to a new, secure wallet. A full system scan using updated security tools is recommended to detect potential secondary infections. Monitoring for unauthorized transactions on all linked accounts is critical, as attackers may attempt to exploit stolen credentials across multiple platforms. Reporting the incident to relevant blockchain security teams and law enforcement can aid in mitigating further risks.