exoduswallet-tool[.]pages[.]dev

Analysis of the domain exoduswallet-tool.pages.dev indicates a brand impersonation campaign targeting Exodus, a cryptocurrency wallet provider. The domain was registered on February 21, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.44.250, which is associated with AS13335 (Cloudflare, Inc.) in the United States. The domain's nameservers, addyson.ns.cloudflare.com and javon.ns.cloudflare.com, further confirm its hosting on Cloudflare's infrastructure. As of July 23, 2026, the domain returns an HTTP 403 status, and its page title is 'Suspected phishing site | Cloudflare,' suggesting it has been flagged by the hosting provider or security systems.

The domain appears on one security blocklist, and 12 of 93 security vendors on VirusTotal have flagged it as malicious. The SSL certificate is issued by Google Trust Services (WE1), a common certificate authority, which does not mitigate the domain's suspicious nature. Technologies detected include HSTS, Cloudflare, and HTTP/3, typical of modern web infrastructure but not indicative of legitimacy in this context. The Gridinsoft trust score for this domain is 0/100, reinforcing its classification as high-risk.

While the exact content of the site remains unanalyzed, the available evidence—including the domain name, brand impersonation of Exodus, and detection by security vendors—strongly suggests it was designed for cryptocurrency-related fraud. Defenders should treat this domain as malicious and block access to it. Network administrators are advised to monitor for connections to 172.66.44.250 and review logs for any interactions with the domain prior to its takedown. Given its current offline status, further investigation into related infrastructure or associated campaigns may be warranted to identify residual threats.