# exodus--web3--uss.pages.dev — MALICIOUS

> exodus--web3--uss.pages.dev is under investigation for phishing risks. Avoid interacting with this domain and stay vigilant to protect your data.

## Summary
PhishDestroy has identified the domain exodus--web3--uss.pages.dev as potentially involved in generic phishing activities, warranting close monitoring. Although no current detections have been reported by major security vendors, the domain's suspicious naming pattern and hosting context raise concerns about a possible imminent threat targeting users via deceptive tactics.

This domain is registered through Cloudflare, Inc. and resolves to the IP address 172.66.47.118. Despite the lack of detection on VirusTotal, its registration through a popular CDN provider and usage of the pages.dev subdomain suggest it may be leveraging legitimate infrastructure to disguise malicious intent. The domain remains active, and PhishDestroy continues to assess its behavior as part of the investigation seeded under reference 89a15a.

Users are advised to exercise caution and refrain from engaging with exodus--web3--uss.pages.dev or providing any personal or sensitive credentials if prompted. Continuous vigilance and prompt reporting of suspicious activity are critical to mitigate risks. PhishDestroy recommends updating security software regularly and employing multi-factor authentication where possible to enhance protection against emerging phishing threats.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Target brand: Exodus
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-03-10 13:07:01
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.47.118
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: adrian.ns.cloudflare.com noel.ns.cloudflare.com
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 5 vendors flagged
  Vendors: ["ADMINUSLabs", "ChainPatrol", "CyRadar", "Fortinet", "Phishing Database"]
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["PhishDestroy", "MetaMask"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cd7a4-c72e-733c-95e9-e953b710dc67.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/899fff23-db20-4206-8267-dc2a2fe7dc92
- PhishDestroy: https://phishdestroy.io/domain/exodus--web3--uss.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/exodus--web3--uss.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/exodus--web3--uss.pages.dev/
Last updated: 2026-03-19