visit--exodusweb[.]pages[.]dev

Analysis of visit--exodusweb.pages.dev indicates a confirmed phishing domain targeting Exodus cryptocurrency wallet users. The domain, registered on February 21, 2026, through Cloudflare, Inc., was flagged by three security vendors on VirusTotal and appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. Infrastructure analysis reveals hosting on Cloudflare's network (AS13335) with an IP resolution of 172.66.44.99, located in the US. The domain currently returns an HTTP 403 status with a page title 'Suspected phishing site | Cloudflare,' suggesting Cloudflare's automated detection systems have intervened.

SSL certificate issued by Google Trust Services (WE1) and implementation of HSTS and HTTP/3 further align with Cloudflare's standard security configurations. Despite the current offline status, the domain's registration details, blocklist presence, and vendor detections provide strong evidence of malicious intent. Defenders should treat this domain as a high-confidence crypto scam indicator, particularly for Exodus wallet credential theft or fraudulent transaction schemes.

The domain's use of Cloudflare Pages infrastructure is consistent with phishing campaigns leveraging legitimate hosting services to evade detection. No evidence of a phishing kit or exact content analysis is available at this time, but the scam type is classified as a crypto scam based on available intelligence. Network defenders are advised to block the domain and associated IP, monitor for related subdomains, and alert users to potential Exodus wallet impersonation attempts.