pages-exoduse[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat designed to deceive users of the Exodus cryptocurrency wallet. Analysis indicates the site was constructed to replicate the legitimate Exodus interface, likely to harvest wallet credentials or distribute malicious payloads for asset theft. The domain presents a significant risk to users who may unknowingly interact with it under the assumption of legitimacy. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on January 23, 2026, and resolves to the IP address 172.66.45.40. It is currently offline but appears on three security blocklists. The SSL certificate is issued by Google Trust Services (WE1), a common practice among threat actors to lend false credibility. VirusTotal reports 19 out of 95 security vendors flagging this domain as malicious, with detection patterns consistent with crypto wallet impersonation schemes. Mitigation steps for this threat type include immediate blocking of the domain and IP at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to known impersonation domains targeting cryptocurrency services. Users should be educated on verifying domain authenticity before entering wallet credentials, particularly for crypto-related services. Security teams are advised to monitor for similar domains using the Exodus brand or Cloudflare Pages infrastructure, as threat actors frequently rotate domains to evade detection.