en-exdus-w[.]pages[.]dev

This domain, en-exdus-w.pages.dev, is flagged as an active brand impersonation threat targeting Exodus, a multi-asset cryptocurrency wallet provider. Registered on April 28, 2026, through Cloudflare, the domain resolves to 188.114.97.3, an IP address associated with Cloudflare infrastructure in Canada. The page title, 'Exodus Wallet - Secure Multi-Asset Cryptocurrency Wallet,' directly mirrors the branding of the legitimate Exodus service, indicating an intent to deceive users into believing the site is authentic. Google Safe Browsing has classified the domain under 'SOCIAL_ENGINEERING,' and it appears on at least one security blocklist. SSL certification is provided by Google Trust Services, which may lend a superficial appearance of legitimacy but does not mitigate the underlying threat. Analysis of the domain's infrastructure reveals Cloudflare nameservers (dale.ns.cloudflare.com and sima.ns.cloudflare.com) and a current HTTP status of 200, confirming the site remains operational. While 12 of 91 security vendors on VirusTotal have flagged the domain, the exact nature of the payload or redirection behavior is not yet analyzed. Defenders should treat this domain as high-risk, particularly in environments where cryptocurrency transactions or wallet access are common. Network-level blocking and user education regarding brand impersonation tactics are recommended. Further investigation into associated IP ranges and hosting patterns may uncover additional related threats.