exodus-3uu[.]pages[.]dev

The domain exodus-3uu.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative nameservers for the zone are carmelo.ns.cloudflare.com and haley.ns.cloudflare.com, indicating that the domain is fully hosted on Cloudflare's edge platform. TLS termination is performed by a Google Trust Services certificate (WE1), and the service enforces HTTP Strict Transport Security (HSTS). An HTTP request to the root URL returns a 403 status code, suggesting that the site is intentionally restricting access, possibly to avoid automated crawling.

The page title returned by the server is "Anfi Account," while the threat intelligence tags the domain as a brand‑impersonation campaign targeting the cryptocurrency wallet provider Exodus. The campaign is classified as a crypto scam. Reputation scoring is extremely low, with Gridinsoft assigning a trust score of 0 out of 100. VirusTotal analysis shows that 5 out of 93 scanned security vendors flagged the domain, and the domain appears on a single security blocklist.

PhishDestroy has already taken the domain offline, and its status is currently listed as offline. Defenders should block the domain and its associated IP address at perimeter and DNS layers, monitor for any future reuse of the Cloudflare nameservers, and consider adding the IP range of AS13335 to threat‑intel feeds when detecting suspicious crypto‑related traffic. Continuous TLS inspection and HSTS enforcement remain advisable to mitigate potential credential‑stealing attempts that might arise if the site is re‑hosted.