portal-exoudus[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting Microsoft. Analysis indicates the site mimics the Exódus Web3 wallet interface, likely to harvest credentials or distribute malicious payloads under the guise of a legitimate service. The domain exhibits characteristics consistent with phishing infrastructure, including deceptive branding and obfuscated ownership. Infrastructure analysis reveals the domain was registered on April 30, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.46.238, located in Canada. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious Cloudflare-hosted sites. VirusTotal detection shows 3 out of 95 security vendors have flagged this domain, while it appears on one security blocklist and is currently blocked by PhishDestroy. The page title, 'Exódus® Web3 Wallet | Exódus® Browser Extension,' further confirms the intent to deceive users by leveraging a misspelled variation of a known cryptocurrency wallet brand. Mitigation steps for this threat include immediate blocking of the domain and its resolving IP (172.66.46.238) at the network perimeter. Security teams should prioritize monitoring for connections to this infrastructure, particularly in environments where Microsoft services or cryptocurrency-related tools are in use. End-user education should emphasize verifying domain authenticity before entering credentials, especially for financial or authentication-related services. Additionally, organizations should review logs for prior interactions with this domain and investigate any associated endpoints for compromise.