app-exxods-wallt[.]pages[.]dev

Analysis of app-exxods-wallt.pages.dev indicates a high-risk brand impersonation operation targeting users of the Across protocol by masquerading as the Exodus wallet. The domain, created on February 21, 2026, is currently offline with an HTTP 403 status, suggesting Cloudflare or hosting intervention. Infrastructure analysis reveals Cloudflare hosting (AS13335) on IP 188.114.97.3, with nameservers damiete.ns.cloudflare.com and val.ns.cloudflare.com, and an SSL certificate issued by Google Trust Services (WE1). The page title, 'Download Exodus Wallet – Desktop & Mobile App,' directly aligns with the scam type classified as wallet/seed phishing, confirming intent to deceive users into downloading malicious software.

Security vendors have flagged this domain, with 17 of 93 engines on VirusTotal detecting malicious activity. It appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a confirmed threat. The Gridinsoft trust score of 0/100 further corroborates its fraudulent nature. While the domain is currently inaccessible, defenders should treat it as a verified phishing resource.

Historical DNS and WHOIS records should be preserved for forensic analysis, and any residual DNS resolutions or cached pages should be monitored for reactivation attempts. Given the domain's association with Cloudflare Pages and its recent creation, defenders are advised to check for similar patterns in other *.pages.dev subdomains, particularly those mimicking wallet or DeFi services. No evidence suggests this domain is legitimate or affiliated with the official Exodus or Across platforms.