eng-us-exedus[.]pages[.]dev

This domain, eng-us-exedus.pages.dev, was identified as a brand impersonation threat targeting users of Exodus, a cryptocurrency wallet service. The site presented itself as an official Exodus Web3 Wallet portal, using the page title 'Exodus Web3 Wallet® | Next-Gen Crypto Experience - Ultimate Guide' to deceive visitors into believing it was a legitimate platform. Such impersonation sites typically aim to harvest sensitive credentials, such as wallet recovery phrases or private keys, enabling attackers to drain funds from victims' crypto wallets. The risk posed by this domain is heightened by its convincing mimicry of trusted branding and the irreversible nature of cryptocurrency transactions. Analysis indicates the domain was created on April 06, 2026, and registered through Cloudflare, Inc. Despite its recent creation, it had already been flagged on three security blocklists and blocked by multiple security tools, including MetaMask and PhishDestroy. At the time of investigation, the domain resolved to the IP address 172.66.44.83 and used an SSL certificate issued by Google Trust Services, which may have contributed to its appearance of legitimacy. Notably, VirusTotal reported 0 out of 95 security vendors flagging the domain as malicious, suggesting it had not yet been widely detected or analyzed by the broader security community. The domain's infrastructure and low detection rate highlight the challenges in identifying emerging phishing threats. If you visited eng-us-exedus.pages.dev or interacted with its content, immediate action is required to mitigate potential risks. First, disconnect any devices used to access the site from the internet to prevent further data exfiltration. If you entered any sensitive information, such as wallet credentials or recovery phrases, assume your accounts are compromised and transfer any remaining assets to a new, secure wallet immediately. Monitor all linked accounts for unauthorized transactions and enable additional security measures, such as multi-factor authentication, where available. Report the incident to relevant platforms and consider notifying local cybersecurity authorities to aid in tracking and mitigating the threat. Users should also verify the authenticity of any future communications or websites claiming to be associated with Exodus by cross-referencing official sources.