exodusweb3-cdn-pro[.]pages[.]dev

The domain exodusweb3-cdn-pro.pages.dev was registered through Cloudflare, Inc. on March 03, 2026 and is currently listed as offline. Its authoritative name servers are jake.ns.cloudflare.com and vita.ns.cloudflare.com, and DNS resolution points to IP address 172.66.46.236, which belongs to Cloudflare’s AS13335 network in the United States. The site presents a Cloudflare‑generated page titled "Suspected phishing site | Cloudflare" and returns an HTTP 403 status code, indicating that direct access is denied. The TLS certificate is issued by Google Trust Services under the WE1 designation, confirming a valid HTTPS endpoint despite the malicious intent flag.

Infrastructure analysis shows the presence of HSTS, Cloudflare edge services, and HTTP/3 support, all typical of legitimate Cloudflare‑hosted sites but also leveraged by threat actors to obscure origin. Reputation data is extremely poor: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal reports that 2 of 94 scanning engines flagged the domain, providing additional confirmation of malicious use. The domain is explicitly recorded as impersonating the cryptocurrency wallet brand Exodus and is categorized as a crypto‑related scam.

While the page title and blocklist entries clearly indicate a phishing intent, no visual or content analysis is available, leaving the exact payload or credential‑harvesting mechanisms unconfirmed. Defenders should immediately block the domain at network perimeter, update DNS filtering policies to include the associated IP range, and monitor for any resurgence or re‑registration attempts. Continuous threat‑intel feeds should be consulted for new indicators, and any observed traffic to the IP should be treated as suspicious, given the low trust score and multiple blocklist listings.