in-exodusweb[.]pages[.]dev

This domain in-exodusweb.pages.dev was registered on February 24, 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 172.66.47.63 (AS13335, United States). The site presents an HTTP 403 response and serves a certificate issued by Google Trust Services under the WE1 identifier, indicating a valid TLS configuration despite the underlying malicious intent. The domain is hosted behind Cloudflare infrastructure, as confirmed by the presence of HSTS, HTTP/3, and the authoritative nameservers jamie.ns.cloudflare.com and keaton.ns.cloudflare.com. The page title returned by the server is identical to the domain name, “in-exodusweb.pages.dev”, and the campaign is classified as a crypto‑scam that impersonates the Exodus brand.

Detection services have flagged the domain: 11 of 93 vendors on VirusTotal reported it as malicious, and it is listed on three blocklists, including PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high‑risk assessment. The combination of brand impersonation, low‑trust score, and active blocklist entries justifies a high‑risk rating. While the site is currently offline, the observable infrastructure—Cloudflare IP, Google‑issued TLS certificate, and persistent blocklist entries—remains usable for attribution and future monitoring.

The exact content served before takedown has not been captured; therefore, defenders cannot confirm the specific phishing landing page or credential‑collection mechanisms. Analysts should continue to monitor the IP address and associated Cloudflare accounts for re‑use, enforce blocklist updates in web filters, and consider adding the domain to internal deny lists. Additional scrutiny of any future subdomains created under the same Cloudflare account is advisable, given the demonstrated pattern of brand‑targeted crypto scams.