officals-exxous[.]pages[.]dev

Analysis indicates that the domain officals-exxous.pages.dev was registered on 12 Mar 2026 via Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.47.125 located in the United States under ASN 13335. The site presented a TLS certificate issued by Google Trust Services (WE1) and advertised the page title “Exodus Web3 Wallet – Your Gateway to the Decentralized Web,” explicitly targeting the Exodus brand. Classification in the intelligence set labels the activity as a wallet/seed phishing campaign that impersonates Exodus. The domain is currently offline, returning HTTP 403, and has been taken down from public access. Security‑vendor telemetry shows that five of ninety‑four VirusTotal scanners flagged the host, and the domain appears on three external blocklists.

Additional protective services—PhishDestroy, MetaMask, and SEAL—have listed the domain as malicious. Infrastructure analysis reveals the use of HSTS, HTTP/3, and Cloudflare‑provided DNS (autumn.ns.cloudflare.com, cartman.ns.cloudflare.com). The Gridinsoft trust score of 0 / 100 further underscores the malicious nature. Because the site is no longer reachable, direct content analysis is not possible, leaving the exact phishing payload unverified.

Nevertheless, the convergence of brand impersonation, low trust score, vendor flags, and blocklist listings provides strong confidence that the domain was used to harvest cryptocurrency wallet credentials or seed phrases. Defenders should continue to block the IP address and domain at perimeter firewalls, add it to internal URL filtering rules, and monitor for any re‑registration of similar names under the same registrar or Cloudflare‑protected IP space. User awareness messaging should remind Exodus users that the official wallet never requests seed phrases through a web page and to verify URLs before entering any credentials.