official--exo-us[.]pages[.]dev

The domain official--exo-us.pages.dev was created on 2026-02-21 and is currently taken offline, returning an HTTP 403 status with the page title "Suspected phishing site | Cloudflare." Infrastructure analysis shows the domain resolves to 172.66.47.164, an IP owned by AS13335 Cloudflare, Inc. and located in the United States. The site is served behind Cloudflare, uses a Google Trust Services (WE1) TLS certificate, and enforces HSTS while supporting HTTP/3. Registration was performed through Cloudflare, Inc., and the domain relies on Cloudflare nameservers suzanne.ns.cloudflare.com and luke.ns.cloudflare.com. Threat intelligence indicates the site is classified as a brand impersonation campaign targeting the Exodus brand.

It appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal analysis records detections from 10 of 93 security vendors, reinforcing a malicious assessment. Additionally, Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating.

While the exact content of the page has not been publicly disclosed, the combination of a phishing‑related page title, multiple vendor detections, and a zero trust score suggests the domain was used to lure victims under the guise of Exodus. Defenders should add official--exo-us.pages.dev to network and endpoint blocklists, monitor for any re‑registration or similar subdomains using the "official--exo-us" pattern, and enforce strict outbound filtering for Cloudflare‑hosted domains that lack a legitimate business justification. Continuous monitoring of Cloudflare‑registered domains for rapid creation dates and low trust scores can help pre‑empt future impersonation attempts.