ex-exodusw-eb[.]pages[.]dev

This domain, ex-exodusw-eb.pages.dev, is identified as a brand impersonation threat targeting Exodus, a cryptocurrency wallet provider. Analysis confirms the domain was actively impersonating Exodus through a fraudulent web interface titled 'Exodus Web3 Wallet — Presentation.' The domain is currently offline, though prior activity suggests it was designed to deceive users into disclosing sensitive wallet credentials or initiating unauthorized transactions. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on October 25, 2025, and resolved to the IP address 172.66.44.58, located within Cloudflare’s US-based autonomous system (AS13335). Security vendors on VirusTotal flagged the domain as malicious, with 18 of 95 engines detecting it. The domain appears on three independent security blocklists and is associated with an SSL certificate issued by Google Trust Services (WE1). Additional technical indicators include its prior inclusion in threat intelligence feeds maintained by cryptocurrency security platforms and browser-based wallet protection systems. The domain’s current offline status does not eliminate residual risk, as threat actors frequently reactivate or rebrand similar infrastructure. Users who accessed this domain prior to its takedown should immediately revoke any associated wallet permissions, rotate credentials, and monitor transaction histories for unauthorized activity. Organizations are advised to update internal blocklists with the domain and IP address, while security teams should review logs for connections to 172.66.44.58 or related subdomains. Proactive monitoring of newly registered Cloudflare Pages domains impersonating cryptocurrency services is recommended to mitigate similar threats.