us-exxodus[.]pages[.]dev

Analysis of the domain us-exxodus.pages.dev confirms it as a phishing site targeting Ledger cryptocurrency wallet users. The domain, registered on March 3, 2026, through Cloudflare, Inc., was operational until recently and is now offline, returning an HTTP 403 status. Infrastructure analysis reveals Cloudflare hosting (AS13335) with nameservers autumn.ns.cloudflare.com and jim.ns.cloudflare.com, resolving to the IP 172.66.47.18 located in the US. The SSL certificate is issued by Google Trust Services (WE1), and technologies detected include HSTS and HTTP/3, typical of Cloudflare-protected sites.

The page title, 'Getting Start Exódus® Web3 Wallet — Exódus® Browser Extension with Ledger®,' directly impersonates both Exodus and Ledger brands, indicating a wallet or seed-phishing scam. This aligns with the scam type labeled in available intelligence. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is flagged by 8 of 94 security vendors on VirusTotal, reinforcing its malicious classification. Gridinsoft assigns a trust score of 0/100, further confirming its fraudulent nature.

While the exact content of the phishing page remains unanalyzed, the combination of brand impersonation, seed-phishing classification, and detection by multiple security vendors leaves little doubt about its intent. Defenders should treat this domain as confirmed malicious infrastructure and ensure it is blocked at the network and endpoint levels. Given its current offline status, monitoring for re-emergence under similar domains or subdomains is recommended. No evidence suggests this domain is part of a broader campaign, but the use of Cloudflare and a .pages.dev subdomain is consistent with recent phishing trends targeting cryptocurrency users.