doe-exodusweb[.]pages[.]dev

The domain doe-exodusweb.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents a page title of "Suspected phishing site | Cloudflare" and returns an HTTP 403 status code, indicating that the content is currently inaccessible and the domain has been taken offline. VirusTotal analysis shows that 11 of 93 security vendors have flagged the domain as malicious, providing independent corroboration of its threat profile. The TLS certificate is issued by Google Trust Services under the WE1 identifier, confirming that the domain is served over HTTPS with a valid certificate chain.

Detected technologies include HSTS, Cloudflare's CDN, and HTTP/3, all of which are consistent with the hosting infrastructure. The domain appears on a single security blocklist, specifically PhishDestroy, and receives the lowest possible trust scores from both Scamadviser (1/100) and Gridinsoft (0/100). The intelligence explicitly categorizes the activity as a "Crypto Scam" that impersonates the Exodus brand, aligning with the documented brand target.

While the page content has not been captured beyond the title, the combination of vendor detections, blocklist inclusion, low trust scores, and brand impersonation suggests a high likelihood of credential harvesting or illicit cryptocurrency transaction redirection. Defenders should immediately block doe-exodusweb.pages.dev at network perimeter and DNS filtering layers, monitor for any future resolution changes, and update incident response playbooks to include this indicator set. Continuous telemetry should be collected for any related subdomains or similar Cloudflare‑hosted assets that reference the Exodus brand, as attackers may reuse the same infrastructure for subsequent campaigns.