usa-exdosweb3[.]pages[.]dev

This domain, usa-exdosweb3.pages.dev, is identified as a high-risk brand impersonation threat targeting cryptocurrency users under the guise of the Exodus Web3 Wallet. The site presents itself as a portal for secure crypto and NFT access, a common tactic to deceive users into interacting with malicious smart contracts or disclosing private keys. Analysis of the page title, "Exodus Web3 Wallet — Secure Crypto & NFT Access," confirms the intent to impersonate a legitimate cryptocurrency wallet provider, likely to facilitate unauthorized transactions or deploy crypto drainer scripts. Technical indicators reveal the domain was flagged by 13 out of 95 security vendors on VirusTotal, a relatively high detection rate for a newly observed threat. It is registered through Cloudflare, Inc., and resolves to the IP address 172.66.47.7. The domain was created on March 03, 2026, though this date may reflect spoofed registration metadata or a placeholder. It appears on three security blocklists and is actively blocked by at least three major security providers. The SSL certificate is issued by Google Trust Services, and the site employs HSTS and HTTP/3, likely to enhance the appearance of legitimacy. No direct evidence of a specific drainer kit was observed, but the infrastructure aligns with known crypto phishing campaigns. As of the latest verification, the domain has been taken offline, reducing immediate exposure to end users. However, the underlying infrastructure remains a residual risk. The use of Cloudflare’s hosting and CDN services, combined with a valid SSL certificate, suggests the threat actor may redeploy similar domains or reuse the same hosting provider for future campaigns. Users who interacted with this domain prior to its takedown should assume credential or private key compromise and take immediate action, including revoking active sessions, transferring assets to new wallets, and monitoring for unauthorized transactions. Security teams should monitor for related domains using the same hosting provider or SSL certificate issuer to preemptively block emerging threats.