# axodus-web-com.pages.dev — MALICIOUS

> Caution: axodus-web-com.pages.dev is under investigation for phishing. Avoid sharing personal info and verify site legitimacy before interaction.

## Summary
PhishDestroy identifies axodus-web-com.pages.dev as a potentially malicious domain linked to generic phishing activity. Though currently under investigation, this domain poses a risk to users who might be targeted for fraudulent data collection or credential theft. The domain's suspicious use pattern warrants caution.

The domain axodus-web-com.pages.dev is registered via Cloudflare, Inc. and resolves to IP address 172.66.47.131. It appears on one security blocklist, indicating preliminary suspicion by threat intelligence sources. Despite this, VirusTotal scans show no detections from any of the 95 security vendors, suggesting the domain might be newly registered or employing evasion techniques. The domain is hosted on a pages.dev subdomain, which is often used for static site hosting but can be abused for phishing.

Currently, the domain status remains active and under close monitoring by PhishDestroy. Users are advised to avoid interacting with the site and refrain from submitting any personal or sensitive information. Security teams should consider blocking this domain proactively and continue to track emerging intelligence. Further analysis is recommended to confirm the domain's intent and mitigate potential threats.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Target brand: Exodus
- Page title: Exodus Web3 Wallet – Securely Manage Your Crypto & NFTs

## Domain Intelligence
- Registered: 2026-03-05 17:07:01
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.47.131
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: bjorn.ns.cloudflare.com maya.ns.cloudflare.com
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 6 vendors flagged
  Vendors: ["ChainPatrol", "CyRadar", "Fortinet", "Kaspersky", "Phishing Database", "Sophos"]
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["PhishDestroy", "MetaMask"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cbe91-8c83-7365-bee7-6cb89dbcf8c6.png
- Cloudflare Radar: https://radar.cloudflare.com/domains/axodus-web-com.pages.dev
- Wayback Machine: https://web.archive.org/web/https://axodus-web-com.pages.dev
- PhishDestroy: https://phishdestroy.io/domain/axodus-web-com.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/axodus-web-com.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/axodus-web-com.pages.dev/
Last updated: 2026-03-19