helpexodusweb3[.]pages[.]dev

Analysis indicates that the domain helpexodusweb3.pages.dev was actively flagged as a high-risk brand impersonation site targeting Exodus, a cryptocurrency wallet provider. The domain resolved to IP 188.114.96.3, part of Cloudflare's network (AS13335) and hosted in the United States. Infrastructure analysis reveals it was registered through Cloudflare, Inc. on February 21, 2026, with nameservers lorna.ns.cloudflare.com and leif.ns.cloudflare.com. The SSL certificate was issued by Google Trust Services under the WE1 root, and the site enforced HSTS and HTTP/3 protocols, consistent with Cloudflare's security features.

At the time of assessment, the domain returned an HTTP 403 status with the page title 'Suspected phishing site | Cloudflare,' suggesting Cloudflare's automated systems had already intervened. Detection data corroborates this: 16 of 95 security vendors on VirusTotal flagged the domain as malicious, while three security blocklists (PhishDestroy, MetaMask, and SEAL) had already listed it. Trust scores from Scamadviser and Gridinsoft were 1/100 and 0/100, respectively, further indicating high-risk classification. The domain is currently offline, though defenders should note its prior association with crypto-related scams as stated in available intelligence.

While the exact content of the site was not analysed, the combination of brand impersonation, cryptocurrency scam classification, and detection by multiple security vendors confirms the domain posed a credible threat. Defenders are advised to treat this domain as malicious in historical logs, monitor for related infrastructure (e.g., subdomains, reused IPs), and block or alert on any future resolution attempts. The use of Cloudflare Pages suggests potential for rapid redeployment; thus, proactive monitoring of Cloudflare-hosted subdomains with similar naming patterns is recommended.