# docs-exodus-us.pages.dev — SUSPICIOUS

> docs-exodus-us.pages.dev poses a low-risk brand impersonation threat targeting Exodus users. The domain is offline; avoid engagement and monitor updates.

## Summary
PhishDestroy has identified docs-exodus-us.pages.dev as a domain involved in brand impersonation targeting the Exodus brand. The site was flagged for attempting to deceive users by mimicking the legitimate Exodus platform, a common tactic to harvest credentials or distribute phishing content. While the overall risk level is assessed as low, the presence of brand impersonation warrants caution due to possible user confusion and potential credential theft.

The domain docs-exodus-us.pages.dev was registered on March 09, 2026, via Cloudflare, Inc. It resolved to the IP address 188.114.97.3 during its active phase. VirusTotal analysis revealed that 2 out of 95 security vendors flagged this domain, and it appeared on 2 security blocklists, indicating some level of suspicion but not widespread detection at the time of review. The page title detected was "Suspected phishing site | Cloudflare," highlighting that hosting infrastructure providers intervened. This suggests an active response by hosting services to mitigate risk.

Currently, docs-exodus-us.pages.dev is offline, reflecting prompt action likely taken to disrupt the impersonation campaign. PhishDestroy recommends users avoid interacting with this domain or any suspicious links purporting to be Exodus-related. Organizations should continue monitoring for similar brand impersonation attempts and ensure employees and customers are aware of phishing risks. Maintaining robust DNS and email filtering controls will help prevent user exposure to such malicious domains.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 403)
- Target brand: Exodus
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-03-09 13:07:02
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 188.114.97.3
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: daisy.ns.cloudflare.com donovan.ns.cloudflare.com
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 2 vendors flagged
  Vendors: ["ChainPatrol", "alphaMountain.ai"]
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["PhishDestroy", "MetaMask"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cd26a-be2a-779c-a0fe-444b686c102e.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/f8f0450a-034b-4901-8af3-735ba2827341
- PhishDestroy: https://phishdestroy.io/domain/docs-exodus-us.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/docs-exodus-us.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/docs-exodus-us.pages.dev/
Last updated: 2026-03-19