exodus-web3-en[.]pages[.]dev

Analysis of exodus-web3-en.pages.dev indicates a crypto-focused phishing domain impersonating Exodus, a known cryptocurrency wallet provider. The domain, registered on February 21, 2026, through Cloudflare, Inc., currently resolves to the IP address 172.66.44.175, hosted on Cloudflare's infrastructure (AS13335) in the United States. At the time of assessment, the domain returns an HTTP 403 status, with the page title explicitly labeled 'Suspected phishing site | Cloudflare,' suggesting manual or automated takedown actions by the hosting provider. Infrastructure analysis reveals the use of Cloudflare nameservers (aspen.ns.cloudflare.com, devin.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1).

Technologies detected include HSTS and HTTP/3, consistent with Cloudflare's standard security headers. The domain appears on three security blocklists, and nine of 93 security vendors on VirusTotal flagged it as malicious, though the specific detection rules or payloads remain unconfirmed. Blocking actions have been implemented by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a phishing threat. While the domain is currently offline, its registration age (five months at the time of reporting) and prior hosting on Cloudflare's platform suggest a deliberate attempt to exploit the brand's reputation for fraudulent purposes.

Defenders should treat this domain as compromised and maintain blocklist entries, particularly in environments handling cryptocurrency transactions. Further investigation into associated wallet addresses or redirection chains is recommended, though no such artifacts are currently linked to this record. The exact phishing kit or lure mechanism remains unanalyzed due to the domain's offline status.