doc-exod-s[.]pages[.]dev

Analysis of the domain doc-exod-s.pages.dev, observed on July 25 2026, shows a clear brand impersonation attempt aimed at Binance users. The site returned an HTTP 403 status code and presented the page title "Getting Started with Exódus® Web3 Wallet — Exódus® Browser," which aligns with the declared scam type of wallet/seed phishing. Infrastructure inspection reveals the domain resolves to IP address 172.66.44.114, hosted within the United States under ASN 13335 owned by Cloudflare, Inc. The SSL certificate is issued by Google Trust Services under the WE1 identifier, and the domain is served through Cloudflare with HSTS and HTTP/3 enabled, indicating a modern web stack. Registration data shows the domain was created on March 12 2026 and was registered via Cloudflare, Inc., using the nameservers kallie.ns.cloudflare.com and vicky.ns.cloudflare.com.

Threat intelligence indicates that three security blocklists have already listed the domain, and it is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis recorded four detections out of ninety‑four scanning engines, reinforcing the malicious classification. The Gridinsoft trust score of 0 out of 100 further confirms a low reputation. While the site is currently offline, the observed indicators suggest a coordinated effort to harvest cryptocurrency wallet credentials.

Uncertainties remain regarding the exact content served before takedown and any additional infrastructure used for credential exfiltration. Defenders should immediately add doc-exod-s.pages.dev to DNS and URL filtering policies, monitor for similarly named subdomains, and enforce strict wallet address verification controls for Binance‑related transactions. Continuous monitoring of Cloudflare‑hosted domains that reference the Exódus brand is recommended to detect future impersonation attempts.