discover-exodusweb[.]pages[.]dev

Analysis of the domain discover-exodusweb.pages.dev, observed on July 23 2026, indicates that the site was used to impersonate the cryptocurrency wallet provider Exodus. The domain was registered through Cloudflare, Inc. on February 21 2026 and is currently taken offline, returning an HTTP 403 response. DNS resolution points to the IP address 172.66.47.188, which belongs to AS13335 Cloudflare, Inc., located in the United States. The hosting environment advertises HSTS, Cloudflare services, and HTTP/3 support, and the TLS certificate presented is issued by Google Trust Services under the WE1 label, confirming a valid SSL chain.

The page title returned by the server is "Suspected phishing site | Cloudflare", matching the expectation of a blocked or takedown page. Reputation checks show the domain listed on three independent security blocklists and confirmed blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of zero out of one hundred, reflecting an extreme lack of confidence. VirusTotal analysis reports that six of ninety‑three security vendors flagged the domain, reinforcing the malicious assessment.

Overall, the evidence supports a brand‑impersonation campaign targeting Exodus users, likely aimed at crypto‑related credential harvesting. The offline status and 403 response suggest that the site has been seized or disabled, but the infrastructure—particularly the Cloudflare‑fronted IP—could be reused for future campaigns. Defenders should continue to block the domain at perimeter filters, monitor for re‑registration, and incorporate the IP address 172.66.47.188 into threat‑intel feeds. Additional scrutiny of any new subdomains under the pages.dev namespace that reference Exodus is advised, as the attacker may leverage the same Cloudflare account to host further impersonation sites.