chrome-us-exdosweb[.]pages[.]dev

Analysis of chrome-us-exdosweb.pages.dev shows a newly‑registered domain created on October 25, 2025 and immediately flagged by multiple security sources. The domain resolves to 188.114.97.3, an address owned by Cloudflare (AS13335) located in the United States. HTTP requests return a 403 status, and the site presents the Cloudflare‑generated page titled “Suspected phishing site | Cloudflare.” The domain appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans recorded eight detections out of ninety‑four vendors, reinforcing the malicious assessment.

Infrastructure inspection reveals the use of HSTS, Cloudflare’s edge services, and HTTP/3, all typical of threat actors leveraging reputable CDNs to hide origin infrastructure. The registrar is Cloudflare, Inc., and the authoritative nameservers are clara.ns.cloudflare.com and yew.ns.cloudflare.com. A Gridinsoft trust score of 0 / 100 further indicates a lack of legitimacy. Current status shows the site taken offline, but the underlying indicators remain useful for defensive correlation.

Uncertainty exists around any payload or credential‑harvesting pages because the content has not been captured; the assessment relies solely on the observed infrastructure and detection signals. Defenders should block the IP address 188.114.97.3 at network perimeters, add the domain to URL filtering policies, and share the indicator set with threat‑intel platforms. Continuous monitoring of the associated Cloudflare IP range is advised, as the actor may redeploy the campaign on new subdomains or alternate hosts within the same CDN envelope.