fag-doc-exodus-web3[.]pages[.]dev

This domain was observed hosting a suspected phishing page that impersonates the Exodus brand. The site, identified as fag-doc-exodus-web3.pages.dev, was created on 5 March 2026 and is currently taken offline, returning HTTP 403. Infrastructure analysis shows the domain is served through Cloudflare’s network (AS13335) from the United States, resolving to IP 172.66.44.61 and using Cloudflare‑provided nameservers corey.ns.cloudflare.com and vida.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS endpoint despite the malicious intent. The page title returned by the server is “Suspected phishing site | Cloudflare,” indicating that Cloudflare’s anti‑phishing protection has flagged the content.

Reputation data is strongly negative: Gridinsoft assigns a trust score of 0 / 100, and the domain is listed on three public blocklists. It is also blocked by the PhishDestroy, MetaMask, and SEAL filters. VirusTotal analysis shows that one of ninety‑four security vendors flagged the domain, reinforcing the presence of malicious activity. The site advertises a crypto‑scam vector, consistent with the known “Crypto Scam” classification, and actively claims to impersonate Exodus. Uncertainty remains regarding the specific phishing kit or payload, as no detailed content analysis is available beyond the page title.

Defenders should immediately add the domain and its associated IP address to deny‑list rules in perimeter firewalls, DNS filtering solutions, and endpoint protection suites. Monitoring for any re‑hosting attempts on alternative Cloudflare‑owned subdomains is advisable, given the ease of creating new pages.dev URLs. Organizations that use Exodus wallets should reinforce user education on verifying legitimate URLs and consider enabling multi‑factor authentication where possible. Continuous ingestion of blocklist updates and periodic re‑scanning of the domain are recommended to capture any future activity.