web3--exo-us[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation site specifically targeting Exodus, a cryptocurrency wallet provider. The site mimics legitimate Exodus Web3 wallet interfaces to deceive users into divulging sensitive credentials or authorizing malicious transactions, likely functioning as a crypto drainer. The infrastructure is designed to exploit trust in decentralized finance platforms, posing significant financial and data exposure risks to victims. Analysis indicates the domain web3--exo-us.pages.dev was registered through Cloudflare, Inc. on April 09, 2026, and resolves to the IP address 172.66.46.222. It is currently offline but was previously detected by 12 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appears on three security blocklists and is explicitly blocked by MetaMask, PhishDestroy, and SEAL. The SSL certificate is issued by Google Trust Services, and the page title, 'Exodus Web3 Wallet - Your Gateway to the Decentralized World,' directly impersonates the legitimate Exodus brand. Mitigation requires immediate action from both users and security teams. Users who interacted with this domain should revoke any connected wallet authorizations, reset credentials, and monitor transaction histories for unauthorized activity. Security teams should blacklist the domain and associated IP address, deploy detection rules for similar impersonation patterns, and educate users on verifying official domains before entering sensitive information. Given the high-risk nature of crypto drainers, proactive monitoring of decentralized application permissions is critical to prevent asset loss.