exo-ds-web[.]pages[.]dev

Analysis of exo-ds-web.pages.dev indicates this domain was a short-lived phishing site impersonating Exodus Wallet, a cryptocurrency wallet service. The domain was registered on March 6, 2026, through Cloudflare, Inc., and resolved to IP 172.66.44.159, hosted on Cloudflare's network (AS13335) in the United States. The page title, 'Exodus Wallet | Secure Cryptocurrency Wallet for Desktop & Mobile,' directly mimics the branding of the legitimate Exodus service, aligning with the reported scam type of wallet/seed phishing. At the time of assessment, the domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL.

Two of 94 security vendors on VirusTotal flagged the domain as malicious. The domain's SSL certificate is issued by Google Trust Services (WE1), a common certificate authority used by both legitimate and malicious sites. The HTTP status returned a 403 error, suggesting the site may have been taken offline or restricted by the hosting provider. Infrastructure analysis reveals the use of Cloudflare nameservers (collins.ns.cloudflare.com and gannon.ns.cloudflare.com) and technologies such as HSTS and HTTP/3, which are consistent with modern web hosting but do not inherently indicate malicious intent.

The Gridinsoft trust score of 0/100 further corroborates the domain's classification as high-risk. Defenders should treat this domain as confirmed malicious, particularly in environments involving cryptocurrency transactions. While the domain is currently offline, historical DNS and WHOIS records should be preserved for forensic analysis. No evidence suggests this domain is part of a broader campaign, but defenders are advised to monitor for similar patterns involving Cloudflare-hosted pages impersonating cryptocurrency services.