doc-exoxdns-web[.]pages[.]dev

The domain doc-exoxdns-web.pages.dev was registered on March 25, 2026 and is hosted on Cloudflare Pages, resolving to the Cloudflare IP address 188.114.96.3 located in Canada. The site serves an HTTP 200 response and presents the page title "Getting started with Exodus Web3 Wallet," indicating a direct brand impersonation of Exodus. Infrastructure analysis shows the domain is covered by a Google Trust Services / WE1 SSL certificate, but the Gridinsoft trust score is 0 out of 100, reflecting a lack of trustworthiness. The domain appears on one security blocklist and is actively listed by PhishDestroy, confirming its malicious status. VirusTotal scans report five detections out of ninety‑four security vendors, reinforcing the risk assessment. The current risk level is classified as high and the domain remains active. Concrete evidence is limited to the observed page title and the blocklist entries; the full page content has not been publicly dissected, leaving the exact phishing mechanics uncertain. Defenders should block the domain at network perimeter and DNS layers, monitor for any traffic to the associated IP address, and consider sinkholing the domain to prevent credential harvesting. Ongoing surveillance is advised to detect any evolution of the campaign or related infrastructure.