exodusweb-enn[.]pages[.]dev

This domain is flagged for brand impersonation targeting Across wallet users through a fraudulent Web3 wallet guide. The page, titled 'Exodus Web3 Wallet — A Complete Guide,' mimics legitimate wallet documentation to deceive users into disclosing sensitive credentials or installing malicious software. Analysis indicates the domain was designed to exploit trust in the Across ecosystem, potentially leading to unauthorized access to cryptocurrency assets or personal data exposure. Infrastructure analysis reveals the domain was registered through Cloudflare on February 21, 2026, and resolves to the IP address 188.114.96.3 (AS13335, US). It appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The domain is flagged by 18 out of 95 security vendors on VirusTotal, confirming its malicious intent. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the threat, as it is commonly used for both legitimate and fraudulent domains. Users who visited exodusweb-enn.pages.dev should immediately revoke any permissions granted to connected applications or browser extensions. Reset credentials for any accounts accessed during the interaction, particularly wallet recovery phrases or private keys. Monitor transaction histories for unauthorized activity and report the incident to relevant security teams. If malware was downloaded, perform a full system scan using updated security tools and consider restoring the device to a known clean state.