exexodus-docweb3[.]pages[.]dev

Analysis of the domain exexodus-docweb3.pages.dev indicates it was a high-risk crypto scam infrastructure impersonating Exodus, a known cryptocurrency wallet provider. The domain, registered on February 21, 2026, through Cloudflare, Inc., was flagged by multiple security vendors and blocklists before being taken offline. As of July 23, 2026, the domain resolves to the IPv6 address 2a06:98c1:3120::3, hosted on Cloudflare's network (AS13335) in the United States. The SSL certificate, issued by Google Trust Services (WE1), and the use of Cloudflare nameservers (veda.ns.cloudflare.com, khalid.ns.cloudflare.com) align with common phishing infrastructure patterns, though these alone are not definitive proof of malicious activity.

Security vendors detected the domain with 13 out of 95 flagging it on VirusTotal, a notable detection rate for a recently registered domain. It was blocked by PhishDestroy, MetaMask, and SEAL, and appeared on three security blocklists, reinforcing its classification as malicious. The page title, 'Suspected phishing site | Cloudflare,' further suggests Cloudflare's own systems identified and restricted access to the domain. The HTTP status returned a 403 Forbidden response, indicating the site was actively blocked or disabled at the time of analysis.

While the exact content of the site remains unanalyzed, the available evidence—including the domain name's resemblance to Exodus, the scam type classification as a crypto scam, and the detection by security vendors—strongly supports its use in brand impersonation. Defenders should treat this domain as compromised infrastructure and monitor for related domains or IPs leveraging similar naming conventions or hosting patterns. Given its current offline status, further investigation into associated artifacts, such as SSL certificates or linked IPs, may help identify residual threats or connected campaigns.