# ekodu-us-doc.pages.dev — SUSPICIOUS

> Beware of ekodu-us-doc.pages.dev, a phishing site impersonating Exódus® Web3 Wallet. The domain is offline but previously posed a medium risk.

## Summary
PhishDestroy has identified ekodu-us-doc.pages.dev as a phishing domain impersonating the Exódus® Web3 Wallet setup page. This site aimed to deceive users into divulging sensitive information by mimicking the official Exódus® browser extension onboarding process. The threat was classified as medium risk due to its intent to harvest credentials.

The domain was registered on March 4, 2026, through Cloudflare, Inc. and resolved to IP address 172.66.44.126. It appeared on two security blocklists, and VirusTotal flagged it by 3 out of 95 security vendors. The page title suggested a focus on guiding users through the Exódus® wallet installation, increasing its credibility to unsuspecting victims.

Currently, ekodu-us-doc.pages.dev is offline, reducing immediate risk. Users are advised to avoid interacting with suspicious links claiming to offer wallet setups or extensions. It is recommended to verify official sources directly and report any phishing attempts to appropriate security teams or platforms like PhishDestroy.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 403)
- Page title: Ğetting started with Exódus® Web3 Wallet ➖ Exódus® Browser Extenión

## Domain Intelligence
- Registered: 2026-03-04 23:07:01
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.44.126
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: addyson.ns.cloudflare.com ethan.ns.cloudflare.com
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 3 vendors flagged
  Vendors: ["ChainPatrol", "Phishing Database", "Trustwave"]
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["PhishDestroy", "MetaMask"]

## Evidence
- Screenshot: https://i.ibb.co/ZzMSkq7n/89223178e875.png
- Cloudflare Radar: https://radar.cloudflare.com/domains/ekodu-us-doc.pages.dev
- Wayback Machine: https://web.archive.org/web/https://ekodu-us-doc.pages.dev
- PhishDestroy: https://phishdestroy.io/domain/ekodu-us-doc.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/ekodu-us-doc.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/ekodu-us-doc.pages.dev/
Last updated: 2026-03-19