exodusweb3-en-es[.]pages[.]dev

Analysis of exodusweb3-en-es.pages.dev shows the domain was registered through Cloudflare on 02 Mar 2026 and resolves to the Cloudflare‑owned address 172.66.44.164 (AS13335, United States). The site presents the page title “Exodus Web3 Wallet” and is classified as a crypto‑scam that impersonates the Exodus brand. Infrastructure fingerprints indicate the use of Cloudflare services, including HSTS, HTTP/3, and a TLS certificate issued by Google Trust Services under the WE1 root, confirming a legitimate‑looking HTTPS deployment. The HTTP response returned a 403 status code, and the domain is currently taken offline, which aligns with the “offline” status flag.

Reputation metrics are uniformly negative: Gridinsoft assigns a trust score of 0 / 100, Scamadviser 1 / 100, and the domain appears on three public security blocklists. It has been actively blocked by PhishDestroy, MetaMask, and SEAL, and two of ninety‑three VirusTotal scanners flagged it as malicious. The nameservers clay.ns.cloudflare.com and magali.ns.cloudflare.com are standard Cloudflare entries, offering no additional attribution. Defenders should treat any traffic to this host as hostile.

Immediate actions include adding the domain to network‑level deny lists, updating web‑filter signatures, and ensuring that endpoint protection solutions reference the current blocklist entries. Because the domain leverages a legitimate TLS certificate and Cloudflare infrastructure, traditional certificate‑based allowlists may not provide protection; context‑aware detection that inspects URL paths, page titles, or brand‑related keywords is recommended. Monitoring for future re‑registration of similar subdomains under the pages.dev namespace is advisable, as the attacker may attempt to resurrect the campaign after the current takedown.