install-exo-dss[.]pages[.]dev

This domain, install-exo-dss.pages.dev, is identified as a high-risk brand impersonation phishing infrastructure specifically targeting users of the Across protocol. Analysis indicates the threat actor designed the page to mimic a legitimate Web3 wallet interface, with the page title "Exodus Web3 Wallet – Future of Digital Access" intended to deceive victims into believing they are interacting with a trusted digital asset management platform. The domain does not appear to be associated with a known drainer kit at this time, though the impersonation of wallet services suggests credential harvesting or private key theft as the primary objective.

Technical indicators confirm the malicious nature of this infrastructure. The domain was registered on September 12, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.44.149, hosted on AS13335 under the same provider. VirusTotal reports 18 out of 95 security vendors flagging the domain as malicious, while it appears on three independent security blocklists. No Google Safe Browsing (GSB) entries were identified at the time of analysis, though the domain was actively blocked by at least three major security platforms prior to takedown.

As of the latest assessment, install-exo-dss.pages.dev has been taken offline, likely due to enforcement actions by the hosting provider or security teams. However, residual risk remains for users who may have interacted with the domain during its active period. Organizations and individuals are advised to monitor for unauthorized access to digital wallets or accounts associated with the Across protocol, revoke any suspicious permissions, and verify the legitimacy of all wallet-related communications. The use of Cloudflare-hosted infrastructure suggests the threat actor may reuse similar domains or IPs for future campaigns, warranting continued vigilance in monitoring for related indicators of compromise.