page-exodusweb3-en[.]pages[.]dev

On July 24, 2026, analysis of page-exodusweb3-en.pages.dev shows that the domain was registered through Cloudflare, Inc. on February 21, 2026 and resolves to the Cloudflare‑owned address 172.66.45.28 located in the United States under ASN 13335. The site presented the page title “Suspected phishing site | Cloudflare” and returned an HTTP 403 response, suggesting that the host is actively blocking access. The TLS certificate is issued by Google Trust Services under the label WE1, confirming use of a valid certificate chain but offering no protection against malicious intent. A Gridinsoft trust score of 0 out of 100 flags the domain as extremely low‑reputation.

The domain appears on three independent security blocklists and is explicitly listed by PhishDestroy, MetaMask, and SEAL as a malicious resource. VirusTotal scans show that eight of ninety‑five AV engines flagged the domain, reinforcing the suspicion. The site is classified as a crypto‑related scam and specifically impersonates the cryptocurrency wallet provider Exodus. Detected technologies include HSTS, Cloudflare services, and HTTP/3, all typical of Cloudflare‑proxied infrastructure.

Nameservers kai.ns.cloudflare.com and summer.ns.cloudflare.com are consistent with the registrar. Although the domain is currently offline, defenders should continue to block the IP address 172.66.45.28 and the full hostname, monitor any future DNS resolution attempts, and update internal threat intel feeds with the observed indicators. Automated URL filtering should keep the domain on blocklists, and endpoint security solutions should consider the eight VirusTotal detections as a risk indicator. Given the brand impersonation and the low trust score, any inbound traffic that appears to originate from this domain should be treated as malicious, and any credential or private‑key submissions related to Exodus should be assumed compromised.