exodus--web3-io[.]pages[.]dev

Analysis of exodus--web3-io.pages.dev indicates active brand impersonation targeting Exodus, a cryptocurrency wallet provider. The domain, registered on April 24, 2026, through Cloudflare, Inc., currently resolves to 172.66.44.173 (Cloudflare infrastructure in California) and returns an HTTP 200 status. The page title, 'Exodus Web 3 Wallet — Guide, Features & FAQs,' explicitly references Exodus, aligning with the reported scam type of brand impersonation. Infrastructure analysis reveals Cloudflare nameservers (rachel.ns.cloudflare.com, rajeev.ns.cloudflare.com), HSTS enforcement, and HTTP/3 support, which are consistent with both legitimate and malicious deployments. The domain is flagged by three security blocklists, including PhishDestroy and MetaMask, and is assigned a trust score of 0/100 by Gridinsoft. VirusTotal reports 11 detections from security vendors, though the specific nature of these detections remains unconfirmed. Defenders should treat this domain as high-risk due to its active status, brand-targeting behavior, and cross-industry blocking. Recommended actions include immediate blacklisting, monitoring for related subdomains or IP reuse, and alerting users to potential cryptocurrency wallet credential theft or fraudulent transaction attempts. The exact content and functionality of the site have not been analyzed, but the combination of technical indicators and brand impersonation warrants proactive mitigation.