exodus-x-en-home[.]pages[.]dev

Analysis of exodus-x-en-home.pages.dev indicates that the domain is being leveraged for brand impersonation targeting the cryptocurrency wallet provider Exodus. The site’s page title, "Suspected phishing site | Cloudflare," was observed before the domain was taken offline, and the HTTP response returned a 403 status code, suggesting active takedown or blocking. Infrastructure inspection shows the domain resolves to 172.66.47.159, an IP owned by Cloudflare, Inc. (AS13335) located in the United States, and the domain employs HSTS, Cloudflare services, and HTTP/3. The SSL certificate is issued by Google Trust Services under the WE1 authority, confirming use of a legitimate certificate chain.

Registration details reveal the domain was created on February 21, 2026 and is registered through Cloudflare, Inc., with nameservers gene.ns.cloudflare.com and huxley.ns.cloudflare.com. Trust scoring from independent services is extremely low, with Gridinsoft assigning a score of 0 out of 100 and Scamadviser rating the site at 1 out of 100. Malware and phishing intelligence platforms have flagged the domain: 16 of 93 VirusTotal security vendors flagged it, it appears on one security blocklist, and it is blocked by PhishDestroy. The listed scam type is a crypto scam, and the brand target is explicitly identified as Exodus.

While the page content has not been captured due to the offline status, the combination of low trust scores, multiple vendor detections, and the explicit brand impersonation label provides strong evidence of malicious intent. Defenders should add the domain to URL filtering policies, enforce blocklisting at perimeter and endpoint layers, and monitor for any related CNAME or sub‑domain activity under the same Cloudflare nameservers. Continuous re‑query of threat intelligence feeds is advised to capture any re‑hosting attempts that may arise after the current takedown.