exodass-en-io[.]pages[.]dev

This domain is flagged as a high-risk brand_impersonation threat targeting Exodus cryptocurrency wallet users. The infrastructure mimics legitimate wallet services to deceive users into disclosing sensitive credentials or transferring digital assets to attacker-controlled addresses. Analysis indicates the domain is designed to exploit trust in the Exodus brand, presenting a significant risk to individuals managing Bitcoin, Ethereum, and other cryptocurrencies. Infrastructure analysis reveals the domain exodass-en-io.pages.dev was registered through Cloudflare Pages on April 24, 2026, and resolves to the IP address 172.66.47.104, located in California and associated with Cloudflare, Inc. Security vendors on VirusTotal flagged the domain, with 3 out of 95 detecting malicious activity. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Google Trust Services under the WE1 root, a common practice for both legitimate and malicious domains. The page title, 'Exodus Wallet – Manage Bitcoin, Ethereum & More Safely,' closely mirrors the official Exodus branding, further enhancing its deceptive appearance. Mitigation measures should focus on disrupting user interaction with the domain and preventing asset compromise. Network administrators are advised to block the domain and its resolving IP address at the firewall or DNS level to prevent access. End-users should be educated on verifying domain authenticity, particularly for cryptocurrency services, by cross-referencing official brand communications and avoiding links from unsolicited messages. Cryptocurrency holders are urged to enable multi-factor authentication and use hardware wallets for added security. Monitoring for unauthorized transactions and reporting the domain to additional threat intelligence platforms can aid in broader disruption efforts.