web3-exodus-io[.]pages[.]dev

Analysis of the domain web3-exodus-io.pages.dev indicates an active impersonation of the Exodus cryptocurrency wallet brand. The site was registered on February 27, 2026 through Cloudflare, Inc., and resolves to the IP address 172.66.44.84, which belongs to AS13335 Cloudflare, Inc. in the United States. The page title returned by the HTTP response is "How to Use Exodus Web3 Wallet," directly referencing the target brand and confirming the intent to mislead users seeking legitimate wallet guidance. Technical traces reveal the presence of HSTS, Cloudflare edge services, and HTTP/3 protocol support, all typical of Cloudflare‑hosted infrastructure.

The SSL certificate is issued by Google Trust Services under the WE1 label, providing a valid HTTPS handshake that may increase user trust. Security scanners report that four of ninety‑three VirusTotal vendors flagged the domain, and the site is listed on three external blocklists, including PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

The current HTTP status is 403, and the domain has been taken offline, but historical evidence suggests it was used for a crypto‑related scam. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑activation, and update threat‑intel feeds with the associated IP, SSL fingerprint, and observed page title. Additional content analysis is not available, so further investigation is advised if the domain resurfaces.