exduswalletloogin[.]gitbook[.]io

This domain was identified as a high-risk phishing site impersonating Exodus, a cryptocurrency wallet provider. The site presented a fraudulent login interface designed to harvest credentials for Exodus Wallet and its browser extension. Users visiting the page were likely tricked into entering sensitive information, such as private keys or recovery phrases, under the false pretense of accessing their legitimate wallet accounts. Such attacks can lead to unauthorized access, asset theft, and irreversible financial loss in decentralized environments.

Analysis indicates the domain was registered on April 30, 2026, through Cloudflare, Inc., and was hosted on infrastructure associated with GitBook and Google Cloud. At the time of detection, 16 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appeared on three independent security blocklists. The site resolved to the IP address 172.64.147.209 and used a valid SSL certificate issued by Google Trust Services, which may have misled users into believing the connection was secure. Additional technical indicators include the use of Cloudflare, HTTP/3, and HSTS, suggesting an attempt to mimic legitimate service behavior.

If you visited exduswalletloogin.gitbook.io and entered any credentials, recovery phrases, or private keys, immediate action is required. Disconnect any devices used to access the site from the internet and revoke any active wallet sessions. Transfer all assets from the potentially compromised wallet to a new, secure wallet with a fresh seed phrase. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to the legitimate service provider and consider filing a report with relevant cybersecurity authorities or blockchain forensic teams to assist in tracking stolen assets.