en-exo-us[.]pages[.]dev

The domain en-exo-us.pages.dev is currently flagged as an elevated‑risk wallet/seed phishing site. Analysis shows the domain was registered on March 03, 2026 through Cloudflare, Inc., and resolves to IP address 172.66.44.111, which belongs to AS13335 Cloudflare, Inc. in the United States. The hosting infrastructure presents HSTS, Cloudflare services, and HTTP/3 support, and serves an HTTPS certificate issued by Google Trust Services under the WE1 designation. An HTTP request returns a 403 status code, and the page title retrieved from the server reads "Exodus Web3 Wallet – Your Gateway to the Decentralized Web™," indicating an attempt to impersonate the Exodus Web3 Wallet brand.

The site is classified as a wallet/seed phishing operation and is listed on three security blocklists. Detection engines have identified the domain, with five of ninety‑four VirusTotal vendors flagging it as malicious, and it has been blocked by PhishDestroy, MetaMask, and SEAL. Additional reputation metrics are extremely low, with Gridinsoft assigning a trust score of 0 out of 100. Nameservers carmelo.ns.cloudflare.com and serena.ns.cloudflare.com confirm the Cloudflare hosting relationship.

While the site is presently offline, the infrastructure and detection signals remain active, suggesting the possibility of rapid re‑deployment. Defenders should deny any network traffic to 172.66.44.111, add en-exo-us.pages.dev to URL filtering and DNS blocklists, and monitor for similar Cloudflare‑hosted domains that reuse the same page title or SSL certificate. Continuous observation of the associated IP range and related nameservers is recommended to pre‑empt re‑use of this infrastructure for future phishing campaigns.