exoxd-usweb-docs[.]pages[.]dev

The domain exoxd-usweb-docs.pages.dev is identified as a brand impersonation threat targeting Exodus, a cryptocurrency wallet provider. Analysis indicates this domain was specifically designed to mimic the Exodus Web3 wallet interface, as evidenced by the page title 'Getting started with Exodus Web3 Wallet.' The threat type is classified as brand impersonation with an elevated risk level, though the domain is currently offline. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on March 29, 2026, and resolves to the IP address 188.114.96.3. Detection metrics show 14 of 95 security vendors on VirusTotal flagged this domain as malicious. The domain holds a Gridinsoft trust score of 0 out of 100 and appears on one security blocklist. The SSL certificate is issued by Google Trust Services, and the domain employs HSTS, Cloudflare, and HTTP/3 technologies. The domain was blocked by PhishDestroy prior to being taken offline. Current status confirms the domain is no longer accessible, though the infrastructure remains a potential vector for future threats. Organizations and users are advised to monitor for similar domains registered through Cloudflare with recent creation dates, particularly those resolving to 188.114.96.3 or using 'exodus' in subdomains. Blocking the observed IP and implementing detection rules for the page title string 'Getting started with Exodus Web3 Wallet' may mitigate residual risk. Users should verify wallet interfaces exclusively through official Exodus channels and avoid interacting with unsolicited Web3 wallet setup pages.