en-exdus-web[.]pages[.]dev

This domain, en-exdus-web.pages.dev, was created on 21 February 2026 and is hosted on Cloudflare’s network (AS13335, United States) at IP 188.114.97.3. The site is served through Cloudflare’s edge with HSTS and HTTP/3 enabled and presents a Google Trust Services / WE1 SSL certificate, indicating that TLS termination occurs at Cloudflare. The page title returned by the server is "Suspected phishing site | Cloudflare", and the HTTP response code is 403, which is the default block page shown by Cloudflare when a request is denied. The domain is listed on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL.

VirusTotal reports that 16 of 93 scanned scanners flagged the domain as malicious, and Gridinsoft assigns a trust score of 0 / 100. The recorded scam type is credential phishing, suggesting that the site was used to harvest login credentials. Defenders should treat any traffic to en-exdus-web.pages.dev as hostile.

Immediate actions include adding the domain and its resolving IP to network‑level deny lists, updating URL filtering policies, and monitoring for any resurgence of the domain or similar sub‑domains under the pages.dev namespace. Because the site is currently offline, investigators should still collect logs of any past connections and consider forensic analysis of any payloads that may have been delivered when the site was active. Continuous vigilance is advised, as the underlying Cloudflare infrastructure can be reused for future malicious campaigns.