overview-exedos-io[.]pages[.]dev

The domain overview-exedos-io.pages.dev was taken offline as of the report date, July 24, 2026, but historical observations indicate it was used for credential phishing. The site was registered on February 27, 2026 through Cloudflare, Inc., and resolves to the IP address 172.66.47.125, which is owned by AS13335 Cloudflare, Inc. in the United States. Cloudflare infrastructure provides HSTS, HTTP/3, and the site presented a valid SSL certificate issued by Google Trust Services (WE1). DNS resolution uses four Cloudflare nameservers (adi.ns.cloudflare.com, ignat.ns.cloudflare.com, karl.ns.cloudflare.com, tricia.ns.c).

HTTP requests returned a 403 status code, suggesting the content is no longer publicly accessible. Reputation data shows the domain appears on three security blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans recorded six detections out of ninety‑three participating security vendors, reinforcing the malicious classification. The Gridinsoft trust score of 0/100 further confirms a lack of legitimacy.

The page title retrieved was the plain domain name, with no additional branding or content details available for analysis. While the current offline status limits active investigation, the combination of recent creation, Cloudflare‑hosted infrastructure, low trust score, multiple blocklist listings, and vendor detections provides sufficient evidence for classification as a credential phishing campaign. Defenders should continue to block the domain and associated IP, monitor for any re‑hosting attempts, and incorporate the indicator set into threat‑intel feeds to prevent future victim targeting.