docc-exodusweb[.]pages[.]dev

Analysis of the domain docc-exodusweb.pages.dev indicates a confirmed crypto scam operation targeting users of the Exodus cryptocurrency wallet. The domain, registered through Cloudflare, Inc. on March 23, 2026, resolves to the IP address 172.66.47.172, hosted under Cloudflare's infrastructure in Canada. The page title, 'Exodus® Web3 Wallet,' directly impersonates the legitimate Exodus brand, aligning with the scam type classified as a crypto scam in available threat intelligence. As of July 25, 2026, the domain is flagged by 12 of 94 security vendors on VirusTotal, a detection rate that underscores its malicious nature.

It appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, further corroborating its classification as a high-risk threat. The domain's Gridinsoft trust score of 0/100 reinforces its lack of legitimacy. Infrastructure analysis reveals the use of Cloudflare nameservers (eve.ns.cloudflare.com and keaton.ns.cloudflare.com), HSTS, and HTTP/3, alongside an SSL certificate issued by Google Trust Services (WE1), which is consistent with the hosting provider's standard security practices but does not mitigate the domain's malicious intent. The domain is currently offline, returning an HTTP 403 status, which may indicate takedown efforts or a temporary suspension by the hosting provider.

While the exact content of the site remains unanalyzed, the available evidence—including the page title, brand impersonation, and detection by multiple security vendors—confirms its role in a crypto scam campaign. Defenders are advised to maintain blocklist entries for this domain and monitor related infrastructure, particularly any subdomains or IPs associated with Cloudflare's hosting services. Given the domain's recent creation and rapid detection by security vendors, organizations should prioritize awareness of similar impersonation attempts targeting cryptocurrency wallets.