web-web3-exoduss[.]pages[.]dev

The domain web-web3-exoduss.pages.dev was created on February 27, 2026 and is currently taken offline, returning HTTP 403 for all requests. Infrastructure analysis shows the domain is hosted behind Cloudflare, Inc., resolving to the address 172.66.44.58 which belongs to AS13335 in the United States. The SSL certificate presented is issued by Google Trust Services under the WE1 profile, and the site enforces HSTS while supporting HTTP/3, indicating a modern CDN configuration. Registration details reveal the domain was provisioned through Cloudflare with four nameservers (adi.ns.cloudflare.com, chan.ns.cloudflare.com, karl.ns.cloudflare.com, mustafa.ns.c), a common pattern for rapidly deployed phishing infrastructure.

Gridinsoft assigns a trust score of 0 / 100, and three independent security blocklists have already listed the domain. VirusTotal reports four detections out of ninety‑three scanners, corroborating the malicious nature of the site. The page title "Exodua — The Human‑First Web3 Wallet" and the classification of wallet/seed phishing indicate a brand‑impersonation campaign targeting users of the Exodus crypto wallet. The domain is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its threat profile.

While the offline status limits direct observation of page content, the available telemetry confirms a high‑confidence impersonation attempt. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration attempts, and educate users that any unsolicited request for Exodus wallet credentials from a similarly named URL is likely fraudulent. Incident response teams should also incorporate the domain hash into threat‑intel feeds to pre‑empt future campaigns that reuse the same infrastructure or naming conventions.