get-doc-exouds-us[.]pages[.]dev

PhishDestroy identifies the active domain get-doc-exouds-us.pages.dev as an ongoing Exodus brand impersonation campaign, currently under investigation for malicious intent.

This domain was flagged by 4 of 95 VirusTotal vendors at the time of analysis, registered through Cloudflare, Inc., resolves to IP 172.66.44.172, and presents itself as the legitimate Exodus Web3 Wallet & Browser Extension page titled 'Exodus® Web3 Wallet & Browser Extension: The Next Generation'.

Risk assessment places this domain at an elevated caution level due to the high-fidelity replication of Exodus branding and infrastructure leveraging Google Trust Services SSL certificates. Concrete indicators include zero current detections despite active hosting on Cloudflare Pages, which may indicate evasion tactics or delayed signature updates. Immediate recommendations include network-level blocking of 172.66.44.172, user education to verify wallet domains via official Exodus channels, and submission of this IOC to threat intelligence platforms for accelerated takedown. Organizations should treat this domain as hostile and implement countermeasures without delay.