docs-exxodus-web[.]pages[.]dev

This domain, docs-exxodus-web.pages.dev, was registered on 21 February 2026 through Cloudflare, Inc. and is served from Cloudflare’s network (AS13335) with the IP address 188.114.97.3 located in the United States. The site presents a Cloudflare‑issued SSL certificate (Google Trust Services / WE1) and enforces HSTS while supporting HTTP/3, indicating a modern CDN configuration. Access attempts return HTTP 403 and the page title observed is “Suspected phishing site | Cloudflare”, which is a default block page generated by Cloudflare when the content is taken down. The domain is listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL, and a Gridinsoft trust score of 0 / 100 confirms a lack of reputational confidence.

VirusTotal analysis shows five of ninety‑three security vendors flag the domain, reinforcing the malicious classification. The scam type is identified as credential phishing, consistent with the generic “phishing” block page. The elevated risk level assigned by the reporting system reflects the combination of recent registration, low trust score, and vendor detections. Current intelligence indicates the infrastructure has been taken offline, and the domain’s status is reported as offline.

Uncertainty remains regarding any active payload or credential‑harvesting pages because the site is no longer reachable and no further content has been captured. Defenders should continue to block the domain at perimeter filters, update DNS block lists with the documented IP and name server entries (cortney.ns.cloudflare.com, nash.ns.cloudflare.com), and monitor for any re‑registration or resurrection of the host. Because the domain is currently offline, any ongoing attacks would have to rely on cached URLs or previously delivered emails, but the presence on multiple blocklists means that browsers and security products that query Safe Browsing or similar services will already flag it.