exodus-web-com[.]pages[.]dev

Analysis of exodus-web-com.pages.dev indicates a high‑confidence brand‑impersonation campaign targeting users of the Exodus Web3 wallet. The domain was created on 2020-09-02 and is registered through Cloudflare, Inc. Infrastructure inspection shows it resolves to 188.114.96.3, an address owned by AS13335 Cloudflare, Inc., located in the United States. The site enforces HSTS, supports HTTP/3, and presents a TLS certificate issued by Google Trust Services under the WE1 brand, confirming a valid HTTPS endpoint despite the domain’s malicious intent. HTTP requests receive a 403 response, and the current operational status is offline, yet the domain remains reachable for DNS resolution.

VirusTotal analysis records four of ninety-three security vendors flagging the domain, and it appears on one external blocklist. The page title returned from the server reads "Official Site® | Exodus Web3 Wallet | Secure Crypto Management," directly mimicking the legitimate Exodus brand and aligning with the documented scam type of wallet/seed phishing. Gridinsoft assigns a trust score of 0 / 100, and PhishDestroy has already listed the domain as blocked. Nameservers listed are adi.ns.cloudflare.com, dean.ns.cloudflare.com, karl.ns.cloudflare.com, and susan.ns.clo, confirming the use of Cloudflare’s DNS services.

While the site is presently offline, the combination of brand‑specific page title, low trust score, vendor detections, and blocklist inclusion provides strong evidence of malicious intent. Uncertainty remains regarding the exact payload or phishing page content, as no live content could be retrieved. Defenders should immediately block the domain at network and DNS layers, ensure endpoint protection solutions incorporate the observed vendor detections, and monitor for future registrations that reuse the same Cloudflare nameserver pattern or similar brand‑impersonation titles.