exodssweb[.]pages[.]dev

On 24 July 2026, exodssweb.pages.dev was observed serving a HTTP 403 response and is currently taken offline. The domain was registered on 27 February 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.44.209, which belongs to AS13335 (Cloudflare) and is geolocated in the United States. DNS resolution uses the Cloudflare‑provided nameservers adi.ns.cloudflare.com, karl.ns.cloudflare.com, norman.ns.cloudflare.com, and paris.ns.c. The site presented the page title “Exodus® Web3 Wallet | Exodus® Browser Extension — Presentation,” indicating a wallet/seed phishing attempt that targets the Exodus brand, although the provided intelligence lists the brand target as “across.” SSL is delivered by Google Trust Services under the WE1 certificate, and the connection enforces HSTS while supporting HTTP/3, typical of Cloudflare‑protected services.

The Gridinsoft trust score is 0 / 100, and the domain appears on three external security blocklists. VirusTotal analysis shows that 2 of 93 scanning engines flagged the domain as malicious. Additional blocklist sources, including PhishDestroy, MetaMask, and SEAL, have already listed the domain. The evidence confirms a wallet/seed phishing infrastructure leveraging reputable hosting and SSL to increase credibility.

While the site is presently offline, defenders should continue to block the domain at perimeter and DNS layers, monitor the IP address 172.66.44.209 for any future activity, and add the associated nameservers to watchlists. Because the page content has not been captured, the exact phishing payload remains unknown; threat‑intel teams should consider periodic re‑scans in case the site resurfaces. Organizations that use Exodus wallets or related Web3 extensions should alert users to the potential credential‑harvesting attempt and enforce multi‑factor authentication where possible.