enus-exedos[.]pages[.]dev

Analysis of the domain enus-exedos.pages.dev indicates an active phishing infrastructure targeting enterprise users under the guise of Cloudflare services. Registered through Cloudflare, Inc., the domain leverages Cloudflare nameservers (damien.ns.cloudflare.com and ivy.ns.cloudflare.com), a tactic observed in credential-harvesting campaigns to exploit perceived legitimacy. The domain resolves to IP address 172.66.44.141, a Cloudflare-hosted endpoint, which may complicate network-based detection due to shared infrastructure with legitimate services. As of July 29, 2026, the domain appears on one security blocklist and is explicitly blocked by PhishDestroy.

VirusTotal telemetry shows 6 of 91 security vendors flagging the domain, though the absence of additional context (e.g., specific detection rules or payload analysis) limits attribution to a precise threat actor or campaign. No evidence links the domain to a known phishing kit or brand impersonation beyond the generic 'phishing' classification, and the exact content of the site remains unanalyzed. The use of Cloudflare Pages (.pages.dev) as a hosting platform aligns with observed trends where attackers abuse free-tier services to evade takedowns and reduce operational costs. Defenders should prioritize this domain for immediate blocking at the DNS and network layers, given its elevated risk profile.

Security teams are advised to correlate logs for connections to 172.66.44.141 or requests to enus-exedos.pages.dev, particularly from enterprise environments where Cloudflare services are in use. While the domain's registration details are consistent with Cloudflare's infrastructure, the lack of transparency in ownership and the absence of a valid SSL certificate (if applicable) further support its classification as malicious. Additional forensic analysis, including HTTP response headers and page content, is recommended to identify embedded scripts or redirect chains that may reveal secondary infrastructure.