doc-exodusweb9[.]pages[.]dev

On 23 July 2026 the domain doc-exodusweb9.pages.dev was observed to be taken offline. The site presented the page title “Exódus® Web3 Wallet | Exódus® Browser Extension — Presentation”, indicating an attempt to impersonate the Exodus cryptocurrency wallet brand. Infrastructure analysis shows the domain was created on 21 February 2026 and is hosted behind Cloudflare’s network (ASN 13335) with the resolved address 188.114.96.3 located in the United States. The domain uses Cloudflare‑provided nameservers hank.ns.cloudflare.com and selah.ns.cloudflare.com, and serves traffic over HTTP/3 with HSTS enabled. The SSL certificate is issued by Google Trust Services under the WE1 identifier, confirming the use of a valid TLS chain despite the malicious intent.

HTTP responses return a 403 status code, which is consistent with the site being taken down. Reputation signals are strongly negative. Gridinsoft assigned a trust score of 0 out of 100, and the domain is listed on at least one public blocklist, including PhishDestroy which actively blocks it. VirusTotal scans report that ten of ninety‑three security vendors flagged the domain, reinforcing the malicious classification.

The evidence aligns with a crypto‑related brand impersonation campaign targeting users of the Exodus wallet. Defenders should add the A record (188.114.96.3) and the domain name to DNS‑based blocklists, enforce URL filtering for the “pages.dev” sub‑domain space, and monitor for any future re‑registration that attempts to reuse the same branding. Continuous re‑scanning with multi‑engine services is advised to capture any changes in payload or hosting. Because the site is currently offline, immediate remediation focuses on prevention rather than incident response.