eng-us-exdus-web3[.]pages[.]dev

This domain, eng-us-exdus-web3.pages.dev, is identified as a high-risk credential harvesting phishing site designed to deceive users into submitting sensitive login credentials, financial details, or personal information. Analysis indicates the site employs social engineering tactics, likely impersonating trusted platforms such as cryptocurrency wallets, banking portals, or enterprise authentication pages. The domain’s infrastructure and content are engineered to exploit user trust, with cloned interfaces and urgent prompts to bypass rational scrutiny. Given its offline status, the site may have been part of a larger, short-lived campaign targeting users in the financial or decentralized technology sectors. Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain was registered on February 28, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, associated with AS13335 (Cloudflare, Inc.). It appears on three independent security blocklists, and VirusTotal reports 10 out of 95 security vendors flagging the domain as malicious. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of security while the underlying content remains fraudulent. The page title, 'Suspected phishing site | Cloudflare,' further confirms its detection by automated security systems. Users who visited eng-us-exdus-web3.pages.dev or interacted with its content should take immediate remediation steps. All credentials entered on the site must be considered compromised and reset across all platforms where reused. Enable multi-factor authentication (MFA) on critical accounts, particularly financial and email services. Monitor account activity for unauthorized transactions or logins, and review connected devices for signs of compromise. If financial data was submitted, notify relevant institutions and consider placing fraud alerts on credit reports. Organizations should update endpoint protection rules to block the domain and its associated IP, and conduct internal awareness training to prevent similar incidents.