meta-exoduso[.]pages[.]dev

Analysis of meta-exoduso.pages.dev as of July 23, 2026 shows the domain is currently offline, returning HTTP 403 and displaying the page title “Suspected phishing site | Cloudflare”. The domain was registered on February 21 2026 through Cloudflare, Inc., and uses Cloudflare’s DNS with the authoritative name servers millie.ns.cloudflare.com and mario.ns.cloudflare.com. DNS resolution points to 172.66.47.167, an address owned by AS13335 Cloudflare, Inc. located in the United States. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 root, and the web server advertises HSTS, Cloudflare, and HTTP/3 support. Reputation data indicates a severe risk profile.

Gridinsoft assigns a trust score of 0 / 100. VirusTotal records 13 of 93 scanning engines flagging the domain, and the host appears on three external blocklists. Independent blocklist providers PhishDestroy, MetaMask, and SEAL have already listed the domain as malicious. The domain is classified as a crypto‑related scam that impersonates the Exodus brand, consistent with the “brand impersonation” threat type. Evidence confirms the infrastructure is typical of a Cloudflare‑protected phishing operation, but no content analysis beyond the page title is available because the site is offline.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑appearance of the host, and correlate internal logs for connections to 172.66.47.167. Because the domain leverages a trusted SSL certificate, TLS inspection may be required to detect potential payloads if the site becomes active again. Organizations using Exodus or related cryptocurrency wallets should be alerted to the impersonation attempt, and users should be instructed to verify URLs before entering credentials. Ongoing threat‑intel feeds should be consulted for updates, and any new detections should be added to internal blocklists promptly.