eng-us-exdos[.]pages[.]dev

PhishDestroy identifies eng-us-exdos.pages.dev as an active domain engaged in credential theft targeting cryptocurrency users. Assigned a risk level of under_investigation, this domain masquerades as a legitimate service while harvesting sensitive login details and wallet credentials. The infrastructure leverages Cloudflare’s Pages.dev platform, a common vector for phishing campaigns due to its legitimate appearance and rapid deployment capabilities. This domain was flagged with 0 detections across 95 VirusTotal scanners, indicating minimal detection coverage despite active malicious activity. It resolves to IP 188.114.97.3, a Cloudflare-hosted address, and operates under a Google Trust Services SSL certificate, which may lend false legitimacy to potential victims. Registered through Cloudflare, Inc., the domain’s infrastructure aligns with typical phishing-as-a-service operations, where threat actors exploit trusted providers to evade traditional defenses. The absence of detections suggests either a newly deployed campaign or one specifically designed to bypass current detection mechanisms. Mitigation against this credential theft domain requires immediate action. Organizations and individuals should block eng-us-exdos.pages.dev at the network perimeter and DNS level, as the domain is actively resolving. Users are advised to verify URLs before entering credentials and enable multi-factor authentication on cryptocurrency accounts. Additionally, security teams should monitor for traffic to IP 188.114.97.3 and investigate any outbound connections to this address. Given the domain’s low detection rate, proactive hunting for similar infrastructure is critical to prevent credential harvesting attacks.