exodusweb3-n[.]pages[.]dev

PhishDestroy identifies the domain exodusweb3-n.pages.dev as an active brand impersonation threat targeting the Exodus brand. The domain remains under investigation but has not been flagged by VirusTotal vendors, which stands at 0 detections out of 95 analyzed. PhishDestroy flagged the domain immediately due to its clear attempt to mimic Exodus through naming conventions and visual deception tactics.

This domain was registered through Cloudflare, Inc. and resolves to the IP address 188.114.96.3. The domain utilizes a Google Trust Services SSL certificate, which may contribute to a false sense of legitimacy. However, the absence of detections on VirusTotal does not equate to safety; brand impersonation threats often bypass traditional detection methods, relying instead on user trust and urgency triggers to deceive victims into divulging sensitive information or credentials.

While this threat remains under investigation, immediate action is strongly recommended. Users encountering this domain should avoid interacting with it entirely. Organizations are advised to block the domain at the network perimeter and educate employees or customers about the existence of this impersonation attempt. PhishDestroy continues to monitor this threat and recommends reporting any sightings to contribute to collective defense efforts.