exod-eg-sweb[.]pages[.]dev

This domain operates as a confirmed cryptocurrency wallet phishing endpoint, specifically designed to impersonate Exodus Web3 wallet and browser extension interfaces. Analysis indicates the site presents itself as a legitimate wallet portal through its page title 'Exodus® Web3 Wallet | Exodus® Browser Extension — Presentation', attempting to deceive users into entering sensitive credentials or recovery phrases. The infrastructure targets cryptocurrency holders seeking wallet access or extension downloads, a common vector for digital asset theft. Technical evidence confirms malicious classification through multiple detection layers. VirusTotal shows 5/95 security vendors flagging the domain as malicious, while infrastructure analysis reveals registration through Cloudflare, Inc. on April 30, 2026. The domain appears on one security blocklist and resolves to IP address 188.114.96.3 (Cloudflare network, Canada). SSL certificate data indicates Google Trust Services/WE1, suggesting use of legitimate certificate authorities to enhance credibility. The creation date discrepancy (future-dated) may indicate either registration system manipulation or intentional misrepresentation. Users who visited this domain should immediately revoke any wallet access permissions and rotate all cryptocurrency-related credentials. Any entered recovery phrases or private keys must be considered compromised, requiring immediate transfer of assets to new, secure wallets. System scans should be performed to detect potential malware or browser extensions installed during the interaction. Network administrators should block the domain and associated IP address (188.114.96.3) at perimeter defenses. Cryptocurrency exchanges and wallet providers should monitor for transactions originating from credentials potentially exposed through this phishing endpoint.