en-web3-exo[.]pages[.]dev

This domain, en-web3-exo.pages.dev, is flagged as an investment scam infrastructure hosted on Cloudflare Pages. Analysis indicates the domain was created on March 22, 2026, and is currently offline with an HTTP 403 status, suggesting access restrictions or takedown measures. The page title, 'Suspected phishing site | Cloudflare,' aligns with Cloudflare's automated phishing detection, reinforcing its classification as malicious. Infrastructure analysis reveals the domain resolves to IP 172.66.47.159, associated with Cloudflare's network in Canada, and uses Cloudflare nameservers (lloyd.ns.cloudflare.com, teagan.ns.cloudflare.com). The SSL certificate is issued by Google Trust Services (WE1), a common configuration for Cloudflare-hosted domains.

Security vendors and blocklists provide concrete evidence of malicious activity: six of 94 vendors on VirusTotal flag the domain, and it appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0/100, further corroborating its risk. The scam type is explicitly classified as an investment scam, though the exact content or targeted brand remains unconfirmed due to the domain's offline status. Technologies detected include HSTS, Cloudflare, and HTTP/3, typical of modern phishing infrastructure leveraging Cloudflare's CDN for resilience and anonymity.

Defenders should treat this domain as high-risk and maintain blocklist entries. While the domain is currently inaccessible, historical DNS and WHOIS records should be preserved for forensic analysis. Given Cloudflare's frequent use by threat actors for rapid domain deployment, monitoring for re-registration or similar patterns (e.g., web3-themed subdomains on pages.dev) is recommended. No evidence suggests this domain is part of a larger campaign, but its alignment with known investment scam tactics warrants continued scrutiny.