help--exdus-web3-x[.]pages[.]dev

The domain help--exdus-web3-x.pages.dev was created on February 27, 2026 and is registered through Cloudflare, Inc. It resolves to the IP address 188.114.97.3, which is hosted in the United States under ASN 13335 owned by Cloudflare, Inc. The site presented a TLS certificate issued by Google Trust Services under the WE1 identifier, and the infrastructure advertised HSTS, Cloudflare services, and HTTP/3. An HTTP 403 response was observed before the site was taken offline. The page title captured by intelligence reads "Exodus Web3 Wallet – Secure & User-Friendly Crypto Wallet," and the classified scam type is Wallet/Seed Phishing, indicating an attempt to harvest cryptocurrency wallet credentials or seed phrases.

Detection telemetry shows the domain is listed on three security blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis recorded three of ninety‑three security vendors flagging the domain as malicious, and the Gridinsoft trust score assigned a rating of zero out of one hundred, reinforcing the malicious assessment. The overall risk level is elevated, and the current status is offline.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any residual requests to the associated IP address, and update endpoint protection signatures to reflect the three vendor detections. Because the hosting provider is Cloudflare, any future re‑hosting attempts may reuse the same name servers (adi.ns.cloudflare.com, bryce.ns.cloudflare.com, diva.ns.cloudflare.com, karl.ns.clo), so security controls should be configured to deny or alert on traffic to these resolvers when associated with the malicious page title or scam type. Continuous threat‑intel feeds should be consulted for any re‑appearance of the domain or related indicators of compromise.