# fag-doc-exodus-web3.pages.dev — SUSPICIOUS

> fag-doc-exodus-web3.pages.dev is a low-risk phishing site impersonating Exodus. Stay alert and avoid interaction with this offline domain.

## Summary
PhishDestroy identifies fag-doc-exodus-web3.pages.dev as a low-risk brand impersonation threat targeting the Exodus brand. The domain primarily aims to deceive users by mimicking Exodus, a popular cryptocurrency wallet, to potentially harvest credentials or sensitive information.

The domain was registered on March 5, 2026, through Cloudflare, Inc. It resolved to IP address 188.114.97.3 before being taken offline. VirusTotal flagged this domain by 1 out of 95 security vendors, and it appeared on 2 security blocklists, indicating limited but credible suspicion. The page title detected was "Suspected phishing site | Cloudflare," confirming Cloudflare’s protective intervention.

Currently, the domain is offline, reducing immediate risk. Users are advised to remain vigilant and avoid engaging with this or similar suspicious domains. Maintaining updated security software and verifying URLs before entering credentials can help mitigate impersonation threats like this one.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 403)
- Target brand: Exodus
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-03-05 19:07:02
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 188.114.97.3
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: corey.ns.cloudflare.com vida.ns.cloudflare.com
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 1 vendors flagged
  Vendors: ["ChainPatrol"]
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["PhishDestroy", "MetaMask"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cbf47-73a7-76cb-9c79-31414a02ed88.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/c150dca8-1fdb-4c4c-b290-942f06e71c76
- Wayback Machine: https://web.archive.org/web/https://fag-doc-exodus-web3.pages.dev
- PhishDestroy: https://phishdestroy.io/domain/fag-doc-exodus-web3.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/fag-doc-exodus-web3.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/fag-doc-exodus-web3.pages.dev/
Last updated: 2026-03-19