doc-us-exedosz[.]pages[.]dev

PhishDestroy identifies doc-us-exedosz.pages.dev as an active brand impersonation threat targeting Exodus Wallet users. The domain is currently offline but posed a significant risk by mimicking Exodus's Web3 Wallet interface to steal credentials or private keys. The page title, "Getting Started with Exodus Web3 Wallet || Browser Extension®", was designed to deceive users into believing they were accessing a legitimate product.

Technical indicators reveal the domain was created on March 06, 2026, through Cloudflare, Inc., and resolved to IP 188.114.97.3. It appeared on 3 security blocklists and was flagged by 3 out of 95 VirusTotal security vendors. The SSL certificate was issued by Google Trust Services (WE1), which is typical for legitimate sites but was abused here. Despite the low vendor detection rate, the combination of brand impersonation and recent creation date strongly suggests malicious intent.

Given its current offline status, the immediate threat is contained, but users should remain vigilant. PhishDestroy advises never entering credentials or installing browser extensions from unsolicited links. Verify URLs carefully and always navigate to official Exodus Wallet sites directly. If you encountered this domain, change your Exodus password immediately and enable two-factor authentication. Report any similar domains to security teams.