exoduweb[.]pages[.]dev

Analysis of exoduweb.pages.dev indicates a credential phishing operation flagged by multiple security mechanisms. The domain, registered on February 21, 2026, through Cloudflare, Inc., resolves to the IP address 172.66.47.100, hosted on Cloudflare’s US-based infrastructure (AS13335). As of July 23, 2026, the domain is offline, returning an HTTP 403 status with the page title 'Suspected phishing site | Cloudflare,' confirming its classification as malicious by the hosting provider. Security vendors have detected the domain with varying levels of consensus: six out of 93 engines on VirusTotal flagged it as malicious, while independent blocklists such as PhishDestroy, MetaMask, and SEAL have also listed it.

The domain’s trust score from Gridinsoft is 0/100, reinforcing its high-risk status. SSL certification is provided by Google Trust Services (WE1), a common feature among both legitimate and malicious sites leveraging Cloudflare’s services, which does not mitigate the threat. Infrastructure analysis reveals the use of Cloudflare nameservers (faye.ns.cloudflare.com and thaddeus.ns.cloudflare.com) and security technologies such as HTTP/3 and HSTS, which are often employed to obscure malicious activity behind legitimate CDN protections. The domain’s registration under Cloudflare’s registrar and its presence on three security blocklists further corroborate its role in phishing campaigns.

While the exact target or brand impersonation remains unconfirmed due to the domain’s current offline status, the available evidence—including the scam type classification as 'Credential Phishing'—suggests it was designed to harvest user credentials. Defenders should treat this domain as compromised and maintain its blocklist status. Organizations using Cloudflare Pages should audit their configurations to prevent abuse of their subdomains for phishing.