exdus-web3[.]pages[.]dev

The domain exdus-web3.pages.dev was registered on 27 February 2026 via Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.44.166, which is advertised as belonging to AS13335 in the United States. The site is protected by HSTS, serves HTTP/3, and presents a Google Trust Services / WE1 SSL certificate, indicating a valid TLS chain. An HTTP GET returns status 403, suggesting the content is not publicly reachable; the domain is currently taken offline. The page title observed during the brief scan reads “Exodus Wallet – Securely Access, Manage & Grow Your Crypto,” directly referencing the Exodus cryptocurrency wallet brand. This aligns with the listed scam type of “Wallet/Seed Phishing” and the classification of brand impersonation targeting Exodus. Reputation signals are uniformly negative.

Gridinsoft assigns a trust score of 0 out of 100. VirusTotal reports that six of ninety‑three AV engines flagged the domain, and the host appears on three external blocklists. Defensive feeds from PhishDestroy, MetaMask and SEAL have already listed the domain as malicious, confirming active detection by multiple anti‑phishing services. The nameserver set includes adi.ns.cloudflare.com, celeste.ns.cloudflare.com, garret.ns.cloudflare.com and karl.ns, all belonging to Cloudflare’s authoritative DNS infrastructure. Uncertainties remain regarding the exact payload delivered when the site was active; the 403 response prevents direct observation of any phishing form or seed‑exfiltration mechanism.

No additional indicators such as malicious scripts, redirects, or credential‑stealing URLs have been disclosed. Consequently, threat actors may have relied on a brief window of exposure before takedown, or the domain could be part of a larger disposable‑domain campaign. Defenders should block the domain at the DNS layer, add the IP address 172.66.44.