doc-exoduswebd[.]pages[.]dev

The domain doc-exoduswebd.pages.dev was registered through Cloudflare on February 21, 2026 and is presently taken offline. Technical analysis shows the site resolves to the IP address 172.66.44.146, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative name servers are lilith.ns.cloudflare.com and jaxson.ns.cloudflare.com, indicating that the domain relies on Cloudflare’s DNS and edge services. The TLS certificate presented is issued by Google Trust Services under the WE1 designation, confirming a valid HTTPS endpoint despite the malicious intent.

HTTP responses return a 403 status code, and the site advertises HSTS and HTTP/3 support, further demonstrating use of modern web protocols. The page title returned by the server is "Suspected phishing site | Cloudflare," which aligns with the classification of a crypto‑related scam targeting the Exodus brand. VirusTotal scans have recorded eight detections out of ninety‑three participating engines, and the domain appears on at least one public security blocklist. It is also listed by PhishDestroy as a blocked resource.

Reputation scoring from Gridinsoft assigns a zero‑point trust rating, reinforcing the malicious assessment. The observed indicators collectively point to a brand‑impersonation campaign designed to lure Exodus users into a cryptocurrency fraud. Defenders should update web filtering and DNS blocklists to include the domain and its associated IP range, enforce TLS inspection to capture any attempted connections, and monitor for similar Cloudflare‑hosted infrastructure that matches the observed naming pattern. Continuous re‑scanning of the domain’s certificate and HTTP headers is advised, as future re‑activation could occur under the same infrastructure.