web-exoduss-io[.]pages[.]dev

The domain web-exoduss-io.pages.dev was registered through Cloudflare on February 21, 2026 and is presently taken offline. DNS resolution points to IP address 172.66.44.140, which belongs to AS13335 Cloudflare, Inc. in the United States. The domain is served by Cloudflare infrastructure, as evidenced by the presence of four Cloudflare nameservers (adi.ns.cloudflare.com, archer.ns.cloudflare.com, jocelyn.ns.cloudflare.com, karl.ns) and the detection of HSTS and HTTP/3 support. An SSL certificate issued by Google Trust Services (WE1) is active, indicating a valid TLS handshake despite the malicious intent.

The page title returned by the server reads "Suspected phishing site | Cloudflare" and the HTTP response code is 403, suggesting that access to the underlying content is blocked by Cloudflare's security controls. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows that six of ninety-three security vendors flagged the domain, reinforcing the malicious classification. The site is identified as a crypto scam that impersonates the Exodus brand, aligning with the declared brand target and scam type.

Although the site is currently offline, historical evidence indicates it was actively used for brand impersonation and cryptocurrency fraud. Defenders should continue to block the domain at network perimeter devices, update URL filtering policies to include the observed IP and nameserver set, and monitor for any re‑registration attempts. Incident response teams should also advise users of the Exodus wallet to disregard any unsolicited requests originating from this domain and to verify official communications through known Exodus channels.