doe-exodusweb-eky[.]pages[.]dev

The domain doe-exodusweb-eky.pages.dev was created on February 21, 2026 and is presently taken offline. Infrastructure analysis indicates that the domain is hosted on Cloudflare, Inc., as evidenced by the authoritative nameservers sandra.ns.cloudflare.com and isaac.ns.cloudflare.com and the presence of Cloudflare‑provided technologies such as HSTS, HTTP/3, and a Google Trust Services / WE1 SSL certificate. The site resolves to the IPv6 address 2a06:98c1:3120::3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. HTTP requests to the host return a 403 status code, and the page title returned is "Suspected phishing site | Cloudflare," confirming that the domain is being used for malicious activity.

The activity is classified as a crypto‑related scam that impersonates the Exodus brand, matching the supplied brand target and scam type. Independent security services have flagged the domain on three blocklists, and VirusTotal records show that 11 of 93 scanning engines have identified the domain as malicious. Reputation services assign extremely low scores: Gridinsoft rates the domain 0/100 and Scamadviser 1/100, reinforcing the high‑risk assessment.

The domain is already listed as blocked by PhishDestroy, MetaMask, and SEAL, indicating that several anti‑phishing and cryptocurrency wallet protection platforms have taken protective action. Defenders should continue to block the domain at network perimeter and endpoint controls, monitor the associated IP address for any future re‑hosting attempts, and update any threat‑intel feeds with the observed indicators. Given the low trust scores, blocklist presence, and brand impersonation, the domain should be treated as high‑severity and incorporated into incident response playbooks for crypto‑focused phishing campaigns.