start-exodus-io[.]pages[.]dev

On 23 July 2026 the domain start-exodus-io.pages.dev was observed to host a page titled “Getting Started with Exódus® Web3 Wallet — Exódus® Browser”. The page title directly references the Exodus brand and the content type is classified as Wallet/Seed Phishing, indicating an attempt to harvest cryptocurrency wallet credentials. The domain was registered through Cloudflare, Inc. on 6 November 2025 and resolves to the Cloudflare‑owned address 172.66.44.251, located in the United States under ASN 13335. DNS resolution uses Cloudflare’s authoritative name servers matt.ns.cloudflare.com and virginia.ns.cloudflare.com. HTTPS is provided by a Google Trust Services certificate issued by the WE1 intermediate, and the server enforces HSTS and supports HTTP/3, consistent with legitimate Cloudflare‑hosted sites.

An HTTP request returns a 403 status code, and the site has since been taken offline. Reputation checks show a Gridinsoft trust score of 0 / 100 and 13 of 93 VirusTotal scanners have flagged the domain as malicious. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. The combination of brand impersonation, wallet‑seed phishing classification, low trust score, and multiple vendor detections elevates the risk to an “elevated” level.

At present, the exact payload or credential‑collection mechanism cannot be confirmed because the site is no longer reachable, and no additional forensic artefacts such as page source or network traffic have been released. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the same host or related subdomains, and update endpoint detection signatures with the observed certificate chain and HTTP response pattern. Incident response teams encountering attempts to contact this domain should treat any credential submission as compromised and advise affected users to rotate wallet seeds and revoke any associated keys.