doc-exoduswb3[.]square[.]site

The domain doc-exoduswb3.square.site was registered on February 21, 2026 through MarkMonitor, Inc. and is presently taken offline. Infrastructure analysis shows the domain resolves to the IPv4 address 74.115.51.5, which belongs to AS27647 Weebly, Inc. and is geolocated in the United States. The authoritative nameservers listed are ns-810.awsdns-37.net, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, and additional entries truncated in the source data. The site served an HTTPS certificate issued by Let’s Encrypt, identified as version E7. Content delivery appears to be hosted on Amazon Web Services and also utilizes Cloudflare services, indicating a multi‑cloud deployment often leveraged for rapid provisioning.

When queried, the HTTP response returned a 404 status with the page title "404 - Page Not Found," suggesting the malicious front‑end content has been removed or the site is no longer serving its phishing payload. Detection signals show the domain appears on one security blocklist and has been flagged by PhishDestroy. VirusTotal analysis recorded 16 detections out of 93 scanned security vendors, confirming that a notable subset of scanners recognize the domain as malicious. The threat classification is a brand impersonation targeting the cryptocurrency wallet provider Exodus, and the campaign is described as a Crypto Scam. No further detail on the phishing kit or specific payload is available from the current intelligence.

Defenders should continue to block the domain at perimeter defenses, including DNS filtering and proxy controls, and monitor for any re‑activation of the associated IP address or related subdomains. Since the TLS certificate is publicly trusted, reliance on certificate validation alone is insufficient; reputation‑based controls remain essential.