web3-us-exeds[.]pages[.]dev

On July 22, 2026 the domain web3-us-exeds.pages.dev was observed hosting a page titled "Exodus Web3 Wallet - Beautiful Crypto Management" and targeting the Exodus brand. The site was registered on March 09, 2026 through Cloudflare, Inc., and resolves to the IP address 172.66.44.61, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. The SSL certificate is issued by Google Trust Services under the WE1 certificate authority, confirming the use of standard HTTPS termination provided by Cloudflare. HTTP responses return a 403 status code, and the domain is currently taken offline.

VirusTotal scans have recorded 16 detections out of 94 security vendors, indicating that a majority of scanning engines recognise the domain as malicious. Independent reputation services assign extremely low trust scores, with Scamadviser rating the site 1 out of 100 and Gridinsoft rating it 0 out of 100. The domain appears on three public security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and the SEAL blocklist, reinforcing its classification as a high‑risk brand‑impersonation operation. Nameserver configuration lists gemma.ns.cloudflare.com and jose.ns.cloudflare.com, consistent with the registrar information.

No additional technical artefacts such as embedded scripts or redirects are visible from the limited data; the page title and brand reference are the primary indicators of the impersonation attempt. Defenders should add web3-us-exeds.pages.dev to network denial lists, monitor DNS queries for re‑registration, and ensure endpoint protection solutions are updated to flag the domain based on its detection history. Continuous observation of Cloudflare‑hosted infrastructure is advised, as threat actors frequently rotate subdomains within the same provider.