exod-sweb-eng-un[.]pages[.]dev

Analysis of exod-sweb-eng-un.pages.dev indicates a high‑confidence phishing indicator set. The domain was registered through Cloudflare, Inc. on March 06, 2026 and resolves to the Cloudflare‑owned address 172.66.47.52, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated to the United States. The site presents the page title "Suspected phishing site | Cloudflare" and currently returns an HTTP 403 response, consistent with a forced takedown or block. The SSL certificate is issued by Google Trust Services under the WE1 designation, confirming the use of a legitimate TLS chain but offering no assurance about the underlying content.

Reputation data shows the domain appears on three security blocklists—PhishDestroy, MetaMask, and SEAL—demonstrating that multiple independent feeds have flagged it for malicious use. VirusTotal scans report six of ninety‑four security vendors flagging the domain, reinforcing the suspicion of malicious activity. Additionally, Gridinsoft assigns a trust score of 0 out of 100, effectively marking the host as untrusted. Nameserver records point to henry.ns.cloudflare.com and rosemary.ns.cloudflare.com, which are standard Cloudflare resolver entries.

While the exact phishing payload or targeted brand is not disclosed, the convergence of blocklist presence, vendor detections, low trust score, and the explicit page title strongly suggests the domain was employed for a phishing campaign and has since been taken offline. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurrection attempts on the same IP or similar Cloudflare‑hosted sub‑domains, and consider sharing the indicator with threat‑intel platforms to aid broader community awareness. Uncertainty remains regarding the specific lure or credential‑harvesting mechanism used, as no content analysis is available beyond the page title. Further investigation of any archived snapshots could clarify the exact phishing vector.