help-doc-exodusweb3[.]pages[.]dev

This domain, help-doc-exodusweb3.pages.dev, is identified as a high-risk brand impersonation campaign targeting Exodus, a widely used cryptocurrency wallet. The page title, 'Exódus® Web3 Wallet | Exódus® Browser Extension — Presentation,' mimics official Exodus branding, likely to deceive users into interacting with malicious content. No direct evidence of a crypto drainer kit was observed, but the domain’s structure and branding suggest intent to harvest credentials or distribute malicious payloads under the guise of a legitimate wallet extension. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. and resolves to the IP address 172.66.47.85, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain was created on March 07, 2026, though this date may reflect Cloudflare Pages’ automated registration rather than malicious actor activity. VirusTotal detection indicates 10 out of 95 security vendors flagged the domain as malicious. The domain appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious domains. As of the latest assessment, the domain has been taken offline, reducing immediate risk to end users. However, the infrastructure remains registered under Cloudflare, and similar campaigns may re-emerge using comparable naming conventions or hosting providers. Users who interacted with the domain prior to its takedown should revoke any associated wallet permissions, rotate credentials, and monitor for unauthorized transactions. Organizations are advised to update blocklists with the domain and IP address to prevent future access attempts.