eng--us-exedos[.]pages[.]dev

PhishDestroy identifies eng--us-exedos.pages.dev as an elevated-risk domain actively involved in a credential theft campaign. This Pages.dev subdomain leverages brand spoofing tactics to harvest login credentials under the guise of a legitimate service, indicating a targeted phishing operation.

This domain was flagged with an elevated risk level and identified as a credential theft vector. VirusTotal analysis shows 3 out of 95 security vendors flag this domain as malicious. The domain resolves to IP 188.114.97.3 and is registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, which adds a layer of perceived legitimacy to the malicious infrastructure. The domain is part of Cloudflare Pages, a legitimate platform often abused for phishing deployments due to its free hosting and rapid deployment capabilities.

Organizations and users should block eng--us-exedos.pages.dev at the network and endpoint levels. Implement DNS filtering to prevent access and update allowlists to exclude this domain. Users who may have interacted with this domain should rotate credentials immediately, enable multi-factor authentication where possible, and scan for potential credential leaks. Security teams should investigate any internal systems that may have been exposed to this domain and consider a broader review of Pages.dev subdomains to detect similar campaigns.