cloud-exodus[.]pages[.]dev

Analysis of cloud-exodus.pages.dev indicates that the domain was registered through Cloudflare, Inc. on March 02, 2026 and is currently taken offline. The site returns an HTTP 403 status and presents the page title “Suspected phishing site | Cloudflare”, which is a default block page issued by Cloudflare. VirusTotal scans show that five of ninety‑three security vendors flagged the domain, suggesting a moderate level of malicious reputation. The domain resolves to IP address 172.66.44.71, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States.

TLS negotiation is performed with a certificate issued by Google Trust Services under the WE1 label, and the connection advertises HSTS and HTTP/3, consistent with Cloudflare’s edge services. The infrastructure is listed on three external blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The page title and the “Crypto Scam” classification, together with the explicit “Impersonates: Exodus” tag, indicate that the domain was being used to target users of the Exodus cryptocurrency wallet.

At present, no additional payload or content analysis is available because the site is offline, and no further details about the phishing kit or landing page have been disclosed. Defenders should continue to block the domain at perimeter filters, update DNS‑based blocklists with the listed nameservers (amanda.ns.cloudflare.com, henrik.ns.cloudflare.com), and monitor for any resurrection of the domain or related sub‑domains. Given the Cloudflare‑hosted nature of the infrastructure, any future re‑use is likely to retain the same IP range, so alerts on traffic to 172.66.44.71 should be correlated with user activity involving Exodus wallet credentials.