exodusweb3-doc[.]pages[.]dev

This domain is flagged as a high-risk credential theft and brand impersonation threat targeting Exodus wallet users. Analysis indicates the infrastructure was designed to harvest cryptocurrency wallet credentials through deceptive login interfaces mimicking legitimate Exodus services. The threat actor employed social engineering tactics to trick victims into entering sensitive recovery phrases or private keys, enabling unauthorized access to digital assets. Infrastructure analysis reveals the domain exodusweb3-doc.pages.dev was registered through Cloudflare, Inc. on March 26, 2026, resolving to IP address 172.66.46.210. The SSL certificate was issued by Google Trust Services, providing a false sense of security. Security vendors detected the malicious activity with 12 out of 95 engines flagging the domain on VirusTotal. The domain appears on three security blocklists and received a trust score of 0/100 from Gridinsoft. Detection systems including MetaMask, PhishDestroy, and SEAL have blocked access to this infrastructure. The page title displayed 'Suspected phishing site | Cloudflare' before being taken offline. Organizations and individuals should implement the following mitigation measures specific to credential theft and cryptocurrency wallet impersonation. First, verify domain registration dates through WHOIS records to identify suspicious recently created domains. Second, implement DNS-based blocking using the identified IP address 172.66.46.210 and domain name in security controls. Third, deploy email filtering rules to quarantine messages containing references to this domain or similar cryptocurrency wallet terminology. Fourth, conduct user awareness training focused on recognizing cryptocurrency wallet phishing attempts, particularly those requesting recovery phrases or private keys. Fifth, implement multi-factor authentication for all cryptocurrency-related accounts where available. Finally, monitor for unauthorized transactions across all digital asset wallets and revoke access to any suspicious applications or browser extensions.