io-exoduss-download-en[.]pages[.]dev

This domain, io-exoduss-download-en.pages.dev, is identified as a high-risk brand impersonation site specifically targeting Exodus, a cryptocurrency wallet provider. Analysis indicates the site mimics official Exodus download pages, likely designed to distribute malicious software or harvest credentials under the guise of a secure wallet setup and login troubleshooting guide. No direct evidence of a crypto drainer kit was observed, but the context strongly suggests credential theft or malware distribution as the primary objective. Infrastructure analysis reveals the following technical indicators: the domain was registered on October 31, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.45.14, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1). The domain appears on three security blocklists and is flagged by 16 out of 95 security vendors on VirusTotal. The page title, "exodus® Download – Secure Wallet Setup & Login Troubleshooting Guide," further confirms the impersonation intent, leveraging the Exodus brand name to deceive users. As of the latest assessment, the domain has been taken offline, mitigating immediate user exposure. It was blocked by multiple security entities, including PhishDestroy, MetaMask, and SEAL. Despite its offline status, residual risk remains for users who may have interacted with the domain prior to takedown. Organizations and individuals are advised to monitor for unauthorized access attempts or anomalous transactions linked to Exodus wallet credentials. Network-level blocking of the domain and associated IP (172.66.45.14) is recommended as a precautionary measure. Users who accessed the site should assume potential credential compromise and initiate password resets for associated accounts.