off-icial-exo-us[.]pages[.]dev

The domain off-icial-exo-us.pages.dev is a confirmed brand impersonation phishing site targeting Ethereum users. It posed as an Exodus Web3 Wallet interface, specifically designed to steal cryptocurrency seed phrases. The site is currently taken offline, but its elevated risk level stems from its use of a trusted infrastructure provider and its appearance on multiple security blocklists.

Technical indicators confirm the malicious nature of off-icial-exo-us.pages.dev. VirusTotal shows 2 of 95 vendors flagging the domain, including ChainPatrol and alphaMountain.ai. The domain was created on March 2, 2026, through registrar Cloudflare, Inc., and resolves to IP address 172.66.44.193 (US, AS13335 Cloudflare). It appears on 3 security blocklists: PhishDestroy, MetaMask, and SEAL. The SSL certificate was issued by Google Trust Services / WE1, and the page title observed was 'Exodus Web3 Wallet - Your Gateway to the Decentralized Web.' The Gridinsoft trust score is 0/100, and the HTTP status was 403. Technologies detected include HSTS, Cloudflare, and HTTP/3. The scam type is classified as seed_phish.

Users who interacted with off-icial-exo-us.pages.dev should take immediate safety steps. Since this is a seed-phishing scam targeting cryptocurrency wallets, victims must revoke any token approvals granted to the site and move all funds to a new, secure wallet. Change passwords for any accounts used on the site and enable two-factor authentication (2FA) where possible. Monitor for fraudulent activity. Report the domain to PhishDestroy, MetaMask, and SEAL blocklists, as well as to Cloudflare's abuse department.