exexdusweb[.]pages[.]dev

This domain, exexdusweb.pages.dev, is flagged as a high-severity brand impersonation resource specifically targeting Exodus Wallet, a widely used cryptocurrency wallet platform. Analysis indicates the site masqueraded as the legitimate Exodus Web3 Wallet interface, likely designed to deceive users into disclosing sensitive credentials or executing unauthorized transactions. While no explicit drainer kit signatures were recovered from the offline instance, the page title and visual impersonation tactics align with known wallet theft methodologies observed in prior campaigns. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on February 21, 2026, with resolution to IP address 172.66.44.126, geolocated within the United States under AS13335 (Cloudflare, Inc.). The SSL certificate was issued by Google Trust Services (WE1), a common pattern in transient phishing infrastructure. Detection metrics show 18 of 95 security vendors on VirusTotal flagged the domain as malicious, while three independent blocklists have listed it as a confirmed threat. The domain's creation date, well in advance of typical phishing timelines, suggests potential premeditated registration or compromised hosting arrangements. At present, exexdusweb.pages.dev has been taken offline, likely following abuse reports or automated takedown procedures. However, residual risk persists due to the domain's prior association with malicious activity and the possibility of infrastructure reuse. Users who interacted with the site are advised to immediately revoke any connected wallet authorizations, rotate credentials, and monitor transaction histories for unauthorized activity. Organizations maintaining security blocklists should retain this indicator for at least 90 days to mitigate potential re-emergence or lateral movement within related campaigns.