eng-ui-exedos[.]pages[.]dev

Analysis of eng-ui-exedos.pages.dev, observed on 24 July 2026, indicates a credential‑stealing site targeting Ledger users. The domain was created on 2 March 2026 and is registered through Cloudflare, Inc., using the authoritative nameservers angelina.ns.cloudflare.com and randy.ns.cloudflare.com. DNS resolution points to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. An HTTPS handshake presents a certificate issued by Google Trust Services under the WE1 root, confirming the use of a legitimate TLS chain despite the malicious intent. HTTP requests return a 403 status code, suggesting the page is currently inaccessible; the report status is listed as offline.

The page title returned from the server reads “Exodus Web3 Wallet | Exodus® Browser Extension with Ledger® — Presentation,” explicitly referencing both Exodus and Ledger, consistent with the classified scam type of wallet/seed phishing. Security‑vendor scans on VirusTotal show three of ninety‑three engines flagging the domain as malicious. Independent blocklists from PhishDestroy, MetaMask, and SEAL also list the domain, bringing the total blocklist count to three. Additional reputation services, such as Gridinsoft, assign a trust score of 0 out of 100, reinforcing the malicious classification.

Observed infrastructure includes HTTP/3 support, enforced HSTS, and Cloudflare’s edge services, which are typical of fast‑flux or content‑delivery abuse. No further artifacts, such as JavaScript payloads or credential‑capture forms, have been publicly disclosed, leaving the exact phishing page content unverified. Defenders should block the domain at network perimeters, add the IP address 188.114.96.3 to deny lists, and monitor for any future re‑registration of similar subdomains under the pages.dev namespace. Continuous re‑scanning with VirusTotal and inclusion in internal URL reputation feeds are recommended to capture any changes in detection status.