e--xosdeus-web[.]pages[.]dev

The domain e--xosdeus-web.pages.dev is currently active and classified as a high‑risk brand‑impersonation campaign targeting the Exodus brand. The site presents a page titled "Exodus Web3 Wallet® | Next-Gen Crypto Experience," which mimics the legitimate wallet service to lure victims. The campaign was first observed after the domain was created on March 24, 2026, and it continues to serve content with an HTTP 200 response.

Infrastructure analysis shows the domain resolves to IP address 172.66.44.91, which belongs to Cloudflare, Inc. The authoritative nameservers are kallie.ns.cloudflare.com and kyrie.ns.cloudflare.com, confirming that the hosting provider is Cloudflare. The site enforces HSTS, supports HTTP/3, and presents a TLS certificate issued by Google Trust Services under the WE1 profile, indicating a valid SSL/TLS chain. These technical characteristics are consistent with legitimate services but are being leveraged to increase user trust for a malicious impersonation.

Reputation data further corroborates malicious intent. VirusTotal has flagged the domain in 9 out of 95 security vendor scans, and the Gridinsoft trust score is 0 out of 100, reflecting a complete lack of confidence. The domain is listed on a single security blocklist and has been blocked by the PhishDestroy mitigation service. These signals collectively point to a coordinated phishing operation rather than an accidental or benign misconfiguration.

Uncertainty remains regarding the full scope of the campaign, such as the number of compromised accounts or the specific phishing vectors employed beyond the landing page. Defenders should block the domain at network perimeters, enforce URL filtering, and monitor for any credential submissions to the site. Users should be warned to avoid interacting with any site that claims to be an Exodus Web3 Wallet when accessed via the e--xosdeus-web.pages.dev address, and any credentials entered should be considered compromised and rotated immediately.