exodas-io-en[.]pages[.]dev

Analysis of exodas-io-en.pages.dev, observed on July 29, 2026, indicates that the domain is actively used for phishing. The domain resolves to the IPv4 address 188.114.96.3 and is hosted behind Cloudflare’s infrastructure, as evidenced by the authoritative nameservers clay.ns.cloudflare.com and maleah.ns.cloudflare.com. Registration metadata shows the domain was provisioned through Cloudflare, Inc., a common service used by malicious operators to hide true ownership. The domain appears on three independent security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the assessment of malicious intent.

VirusTotal scans have resulted in 11 of 91 security vendors flagging the domain, a detection rate that aligns with high‑risk classifications. The threat is cataloged as generic phishing with a high risk rating and remains active at the time of reporting. No public page title or SSL certificate details are presently available, limiting deeper content analysis.

Defenders should therefore add the domain and its resolved IP address to deny‑list policies, monitor outbound connections to the IP, and consider broader Cloudflare edge‑network blocks if feasible. Continuous re‑scanning of the host is advised, as additional detections may emerge. The combination of blocklist presence, multiple vendor detections, and hosting under a privacy‑focused registrar provides sufficient evidence to treat exodas-io-en.pages.dev as a confirmed phishing infrastructure.