io-exodus-w3-wllt-en[.]pages[.]dev

On July 23, 2026, the domain io-exodus-w3-wllt-en.pages.dev was recorded as a high‑risk brand‑impersonation site targeting the Exodus cryptocurrency wallet. The domain was created on February 21, 2026 and registered through Cloudflare, Inc., using the authoritative nameservers maya.ns.cloudflare.com and nikon.ns.cloudflare.com. DNS resolution points to the IP address 172.66.46.246, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 authority, indicating a legitimate‑looking HTTPS endpoint. HTTP requests return a 403 status code and the page title reported by the server is “Suspected phishing site | Cloudflare”.

Automated analysis identified the use of HSTS, Cloudflare’s edge platform, and HTTP/3. VirusTotal scanning shows that twelve of ninety‑five security vendors flagged the domain, reflecting a moderate level of consensus on malicious behavior. The domain appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, demonstrating that multiple defensive products have incorporated it into their deny lists. Gridinsoft assigned a trust score of 0 out of 100, further corroborating the malicious assessment.

Because the site is currently offline, no additional content or credential‑harvesting pages could be retrieved, leaving the exact phishing payload unknown. Nevertheless, the combination of brand impersonation targeting Exodus, the classification as a crypto‑scam, and the observed infrastructure attributes provide sufficient evidence for defensive action. Organizations should add the domain and its associated IP address to blocklists, enforce DNS filtering, and monitor for any newly‑registered subdomains that mimic the observed naming pattern. Continuous re‑scanning of the domain, especially if it reappears, is advised to capture any changes in payload or hosting configuration.