doc-exodus-web3-en-us[.]pages[.]dev

The domain doc-exodus-web3-en-us.pages.dev was registered on February 28, 2026 and is currently taken offline. Technical probing shows the hostname resolves to the Cloudflare‑owned address 172.66.44.58, which belongs to AS13335 in the United States. An HTTPS request returns a 403 status code, indicating that the server is deliberately denying access, a pattern often observed when phishing infrastructure is being dismantled or redirected. The TLS certificate is issued by Google Trust Services under the WE1 name, confirming that the connection is terminated at Cloudflare’s edge rather than a self‑signed or malicious certificate. The site’s page title, "Exódus® Web3 Wallet & Browser Extension," explicitly references the Exodus brand and aligns with the classified scam type of wallet or seed phishing, suggesting an attempt to harvest cryptocurrency seed phrases from unsuspecting users.

Cloudflare is listed as the registrar, and the domain uses four Cloudflare nameservers (adi.ns.cloudflare.com, brodie.ns.cloudflare.com, karl.ns.cloudflare.com, ursula.ns.). Detected technologies include HSTS, HTTP/3, and the Cloudflare CDN, all of which are typical for legitimate services but also for threat actors seeking resilience and encryption. Reputation checks show the domain appears on three security blocklists and has been flagged by PhishDestroy, MetaMask, and SEAL, reinforcing the conclusion of malicious intent. VirusTotal analysis reports five out of ninety‑three scanners flagging the domain, while Gridinsoft assigns a trust score of zero out of one hundred, indicating a high confidence of abuse.

The combination of brand impersonation, a wallet‑focused lure, and the observed security signals suggests the infrastructure was designed to lure Exodus users into submitting private keys or recovery phrases. Defenders should continue to block the domain at network perimeter, update URL filtering lists, and monitor for any resurgence of the hostname or related subdomains.