us-ekodus-doc[.]pages[.]dev

The domain us-ekodus-doc.pages.dev has been taken down, but not before it was flagged by 14 out of 94 vendors on VirusTotal as malicious. Public blocklists, including PhishDestroy, MetaMask, and SEAL, have identified this domain as a threat. It impersonates Exodus, a well-known Web3 wallet, to phish for users' seed phrases.

The website's page title, 'Exódus® Web3 Wallet ➖ Exódus® Browser Extension,' is designed to mimic the legitimate Exodus brand. Hosted by Cloudflare, Inc., the domain was created on October 28, 2025, and detected by PhishDestroy on March 16, 2026. Despite being offline now, the domain's initial activity highlights the ongoing threat of phishing campaigns exploiting brand trust.

Seed phishing scams like this one aim to steal sensitive information by tricking users into entering their seed phrases. This type of attack can lead to significant financial losses for victims. The domain's platform risk score of 85/100 underscores the severity of the threat it posed during its active period. Such domains often exploit the gap between registration and detection by antivirus vendors, making early identification crucial.