doc--exodus--web[.]pages[.]dev

PhishDestroy identifies the active domain doc--exodus--web.pages.dev as a generic phishing endpoint hosting a crypto drainer kit impersonating the legitimate Exodus Wallet application. The page leverages a deceptive naming pattern with double hyphens and the official .pages.dev suffix to mislead victims, exploiting trust in Exodus’s branding to facilitate cryptocurrency theft. This domain represents a significant threat to users seeking to manage digital assets, as it is designed to silently siphon funds upon wallet connection. This domain exhibits several suspicious technical indicators. It was scanned by VirusTotal, where only 3 out of 95 security vendors currently flag it, indicating limited early detection. The domain is registered through Cloudflare, Inc., which is commonly used to obfuscate malicious infrastructure behind proxy services. It resolves to the IP address 188.114.96.3, which is hosted within Cloudflare’s infrastructure. The SSL certificate is issued by Google Trust Services, adding a layer of legitimacy that could deceive non-technical users. As of the latest intelligence, no public blocklist entries have been confirmed for this domain, suggesting it may be newly active or actively evolving to avoid detection. As of today, the status of doc--exodus--web.pages.dev remains active and responsive. Immediate response actions include blacklisting the domain at the network and DNS level, and sharing IOCs with trusted threat intelligence partners. Despite these measures, the remaining risk remains elevated due to the domain’s cloaking under Cloudflare, the use of Google Trust Services for SSL, and limited vendor detection on VirusTotal. Users are strongly advised to verify any Exodus-related URL using PhishDestroy’s scanning tool and to cross-check URLs against official Exodus domain lists before interacting with wallet interfaces.