en-us-web3exxods[.]pages[.]dev

Analysis of en-us-web3exxods.pages.dev, observed on July 25 2026, indicates a brand‑impersonation campaign targeting the “across” Web3 ecosystem. The site is hosted on Cloudflare infrastructure (IP 172.66.46.226, AS13335, United States) and uses Cloudflare’s HSTS and HTTP/3 features. The SSL certificate is issued by Google Trust Services under the WE1 authority, confirming TLS termination at Cloudflare. Registration was performed through Cloudflare, Inc. on March 12 2026, and the authoritative nameservers are felipe.ns.cloudflare.com and zara.ns.cloudflare.com. An HTTP request returns a 403 status, suggesting the content is currently inaccessible; the domain has been taken offline.

The page title collected from the site – “Exódus® Browser Extension && Exódus® Web3 Wallet | Chrome Web Extension” – reveals the malicious operator is advertising a counterfeit browser extension and Web3 wallet, consistent with the documented wallet/seed phishing vector. The campaign is classified as a brand impersonation attempt against the “across” brand. Threat intelligence feeds have placed the domain on three security blocklists, and it is actively blocked by PhishDestroy, MetaMask, and the SEAL filtering engine. On VirusTotal, six of ninety‑four scanners reported the domain as malicious, confirming a low trust rating. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious disposition.

Given the observed infrastructure, defenders should add en-us-web3exxods.pages.dev to URL filtering policies, block the associated IP range 172.66.46.0/24 where feasible, and ensure that endpoint security solutions recognize the domain as malicious. Monitoring for newly created subdomains under pages.dev that reference “Exódus” or similar Web3‑wallet terminology is advisable, as the actors may reuse the same Cloudflare account for future campaigns.