eng-usa-exedos[.]pages[.]dev

The domain eng-usa-exedos.pages.dev has been identified as a brand impersonation threat, specifically targeting the Exodus cryptocurrency wallet brand. This domain was designed to deceive users into believing they are interacting with the legitimate Exodus Web3 Wallet, as evidenced by its page title "Exodus Web3 Wallet – Next-Gen Crypto Security". The site likely hosts a phishing kit aimed at stealing wallet credentials or private keys, posing a direct financial risk to users.

Technical analysis reveals critical indicators of malicious intent: VirusTotal reports 6 out of 95 security vendors flagging this domain as malicious, and it appears on 3 security blocklists. The domain was created on March 3, 2026, and is registered through Cloudflare, Inc., a common registrar for malicious sites due to its privacy features. It resolves to IP address 172.66.47.77 and uses an SSL certificate issued by Google Trust Services / WE1, which can lend a false sense of legitimacy. Notably, the domain is not currently listed on Google Safe Browsing (GSB), which may allow it to bypass some browser warnings.

As of the latest intelligence, the domain has been taken offline, which is a positive development. However, due to the elevated risk level and the specific targeting of Exodus users, PhishDestroy advises continued vigilance. Users who may have interacted with this site should immediately change their Exodus wallet passwords and enable two-factor authentication. Monitoring for unauthorized transactions is also recommended. The domain's rapid creation and takedown suggest a coordinated campaign that may resurface under similar variations.