homepage-exdusweb-us[.]pages[.]dev

This domain is flagged as a brand impersonation threat targeting MetaMask wallet users, currently under investigation with a status of offline. The specific threat type involves credential harvesting and wallet seed phrase theft, designed to compromise cryptocurrency assets through deceptive interfaces mimicking legitimate wallet services. Analysis indicates the domain homepage-exdusweb-us.pages.dev was registered through Cloudflare, Inc. on October 29, 2025, and resolves to the IP address 172.66.47.156. Despite showing 0 detections out of 95 on VirusTotal, it appears on three security blocklists and has been blocked by MetaMask, PhishDestroy, and SEAL. The SSL certificate is issued by Google Trust Services, and the infrastructure employs HSTS, Cloudflare, and HTTP/3 technologies. The page title was recorded as Suspected Phishing | Cloudflare before being taken offline. Mitigation steps for this threat type include immediate verification of wallet security settings, revocation of any suspicious connected applications, and enabling hardware-based authentication where available. Users should cross-reference official communication channels for any alerts regarding credential exposure and monitor transaction histories for unauthorized activity. Security teams are advised to update blocklists with the domain and IP address, while maintaining awareness of similar impersonation patterns leveraging content delivery networks and valid SSL certificates to appear legitimate.