exodusweb3-cdn[.]pages[.]dev

Analysis of exodusweb3-cdn.pages.dev indicates a high-risk phishing domain targeting Exodus wallet users, currently offline as of July 24, 2026. The domain was registered on March 3, 2026, through Cloudflare, Inc., and resolves to IP 188.114.96.3, hosted on Cloudflare's network (AS13335) in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (jake.ns.cloudflare.com, vita.ns.cloudflare.com), HSTS, HTTP/3, and a Google Trust Services SSL certificate (WE1). The page title, 'Exodus Nebula Web3 Wallet,' directly impersonates Exodus, a known cryptocurrency wallet provider, aligning with the classified scam type of wallet/seed phishing.

The domain is flagged by 10 of 94 security vendors on VirusTotal and appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. At the time of assessment, the domain returns an HTTP 403 status, suggesting it has been taken offline or restricted, though this does not eliminate residual risk. No evidence of active exploitation or victim reports is currently available, but the combination of brand impersonation, phishing-specific infrastructure, and blocklist presence justifies high-risk classification.

Defenders should treat this domain as compromised and maintain blocklist entries. Monitoring for re-emergence under similar naming conventions (e.g., 'web3,' 'nebula,' or 'cdn' subdomains) is recommended. Organizations using Exodus or similar wallet services should proactively warn users about seed-phishing threats and verify domain authenticity before interaction. Given the domain's association with Cloudflare Pages, reviewing other hosted projects under the same registrar may identify additional threats.