faq-doc-exodusweb3[.]pages[.]dev

The domain faq-doc-exodusweb3.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 188.114.97.3, which is located in the United States under ASN 13335. The site presents a Cloudflare‑issued SSL certificate signed by Google Trust Services (WE1) and advertises security features such as HSTS and HTTP/3, suggesting the infrastructure is deliberately configured to appear legitimate. The page title returned by the server is "Suspected phishing site | Cloudflare" and the HTTP response code is 403, indicating the content is currently blocked or unavailable. Threat intelligence shows the domain is classified as a crypto‑related scam that impersonates the Exodus brand, and it has been flagged by three of ninety‑five VirusTotal scanners.

PhishDestroy has taken the domain offline, and it appears on a single public security blocklist. Additional reputation data includes a Gridinsoft trust score of zero out of one hundred, reinforcing the malicious assessment. Nameservers listed for the domain are vida.ns.cloudflare.com and corey.ns.cloudflare.com, both standard Cloudflare delegations. While the exact payload or phishing page content has not been captured, the convergence of brand impersonation, crypto scam labeling, low trust scoring, and active blocklist placement provides strong evidence of malicious intent.

Defenders should continue to block the domain at perimeter controls, monitor for any resurgence of the host IP or related Cloudflare edge nodes, and update internal blacklists with the full domain string. Given the Cloudflare‑based hosting, any future re‑hosting attempts may use different subdomains under the same provider, so threat‑hunting queries should include the IP 188.114.97.3 and associated nameserver patterns. Continuous verification against VirusTotal and other sandbox services is advised to capture any evolving payloads.