offical-exouss[.]pages[.]dev

offical-exouss.pages.dev was observed hosting a page titled “Exodus Web3 Wallet – Your Gateway to the Decentralized Web”. The page title explicitly references the Exodus brand, indicating a brand‑impersonation attempt aimed at cryptocurrency users. The domain was created on 23 March 2026 and resolves to the IP address 188.114.97.3, which is owned by Cloudflare, Inc. and geolocated to Canada. Registration was performed through Cloudflare, Inc., and the authoritative nameservers are leonidas.ns.cloudflare.com and shubhi.ns.cloudflare.com.

The site presented an SSL certificate issued by Google Trust Services under the WE1 label, and HTTP responses returned a 403 status code, suggesting that the content is presently inaccessible. The hosting infrastructure advertises HSTS, Cloudflare services, and HTTP/3 support. Threat intelligence indicates the site was classified as a “Crypto Scam” and is listed on one security blocklist. The domain was blocked by the PhishDestroy feed, and VirusTotal recorded 13 detections out of 94 scanning engines.

Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The current status is offline, but the combination of brand impersonation, malicious hosting, and low trust scores warrants an elevated risk rating. Defenders should add the domain and its resolved IP to deny‑list rules, monitor for newly registered domains using the “exouss” or “exodus” lexical patterns, and enforce strict outbound filtering for Cloudflare‑hosted endpoints that serve similar page titles. Continuous observation of the associated blocklist entries and periodic re‑scans of the domain are recommended to capture any future re‑activation.