eg-exodusweb[.]pages[.]dev

Analysis on July 22, 2026 indicates that eg-exodusweb.pages.dev was created on February 26, 2026 and registered through Cloudflare, Inc. The domain resolves to IP address 172.66.44.153, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. DNS resolution is handled by four Cloudflare‑associated nameservers: adi.ns.cloudflare.com, brit.ns.cloudflare.com, karl.ns.cloudflare.com, and tosana.ns.cl. The site presents an SSL certificate issued by Google Trust Services under the WE1 designation and enforces HTTP Strict Transport Security (HSTS) while supporting HTTP/3, confirming the use of modern Cloudflare edge services. An HTTP request returns a 403 status code and the page title "Suspected phishing site | Cloudflare," indicating that the content has been taken down or blocked by Cloudflare’s protective mechanisms.

The domain is tagged as impersonating the Exodus brand and classified as a crypto‑scam. It appears on three independent security blocklists and has been specifically blocked by the PhishDestroy, MetaMask, and SEAL filtering platforms. Independent reputation scoring assigns a Gridinsoft trust score of 0 out of 100, reflecting an extremely low confidence level in the site's legitimacy. VirusTotal analysis shows that 2 out of 93 scanning engines flag the domain, reinforcing the suspicion of malicious intent.

Given the convergence of brand impersonation, low trust scoring, blocklist presence, and partial detection by multiple security vendors, defenders should treat eg-exodusweb.pages.dev as a high‑risk indicator. Recommended mitigations include adding the domain and its resolving IP address to network‑level deny lists, updating endpoint protection signatures to capture the observed indicators, and monitoring for any re‑registration or alternative hosting that may attempt to resurrect the campaign.