io-en-exodus[.]pages[.]dev

Analysis of the domain io-en-exodus.pages.dev indicates a high-risk brand impersonation campaign targeting Exodus, a cryptocurrency wallet provider. The domain, registered on February 21, 2026, through Cloudflare, Inc., was flagged as a crypto scam by multiple security vendors and blocklists. As of July 23, 2026, the domain resolves to a Cloudflare-hosted IPv6 address (2606:4700:310c::ac42:2f84) under AS13335 and is currently offline, returning an HTTP 403 status. The page title, 'Suspected phishing site | Cloudflare,' aligns with its classification by 16 of 93 security vendors on VirusTotal, though the exact content of the phishing page remains unconfirmed due to its offline status.

Infrastructure analysis reveals the use of Cloudflare nameservers (lilyana.ns.cloudflare.com, santino.ns.cloudflare.com) and technologies such as HSTS and HTTP/3, which are consistent with modern phishing operations leveraging CDN protections to evade takedowns. The SSL certificate, issued by Google Trust Services (WE1), provides no additional attribution beyond the hosting provider. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, further corroborating its malicious classification. Defenders should treat this domain as compromised and prioritize blocking it at the DNS and network levels.

Given its association with crypto scams, monitoring for wallet-draining scripts or credential-harvesting attempts is recommended if the domain reactivates. The registration date and hosting provider suggest a deliberate, short-lived campaign, typical of phishing operations targeting cryptocurrency users. No additional scam-specific indicators (e.g., fake login forms, wallet addresses) are available for analysis at this time.