homepage-exdoua-io[.]pages[.]dev

This domain presents an elevated risk as it is a confirmed brand impersonation targeting Exodus, a popular cryptocurrency wallet. The site was designed to trick users into believing they were accessing legitimate Exodus Web3 Wallet setup pages, potentially stealing login credentials or seed phrases. Although the domain is currently offline, its prior activity and registration details suggest a deliberate phishing campaign.

According to VirusTotal, 3 out of 95 security vendors flagged this domain as malicious. It was registered through Cloudflare, Inc. on September 30, 2025, and resolves to IP address 188.114.97.3. The SSL certificate was issued by Google Trust Services (WE1). The domain appears on 3 security blocklists, indicating multiple threat intelligence sources have identified it as harmful. The page title explicitly reads "Getting Started with Exodus Web3 Wallet," further confirming the impersonation.

Users who may have interacted with this site should immediately change their Exodus wallet passwords and enable two-factor authentication. If any seed phrases or private keys were entered, those wallets should be considered compromised, and funds should be moved to a new, secure wallet. Always verify URLs by checking the official Exodus website directly, and avoid clicking links from unsolicited messages. PhishDestroy recommends running a full antivirus scan and reporting the incident to Exodus support.