pro[.]egdlex[.]exchange

The domain pro.egdlex.exchange is currently active and classified as a high‑risk generic phishing site. Infrastructure analysis shows the hostname resolves to 104.21.52.8, an address owned by Cloudflare (AS13335) located in the United States. The site is protected by HSTS, serves HTTP/3 traffic, and presents a Google Trust Services / WE1 SSL certificate. DNS is hosted on Cloudflare name servers sarah.ns.cloudflare.com and nikon.ns.cloudflare.com. Registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED. The page title returned by the server reads “edgeX – High‑performance, orderbook‑based perpetual DEX with native trading experience,” indicating the site is attempting to masquerade as a decentralized exchange platform. VirusTotal scans have flagged the domain by 10 of 91 security vendors, and the domain appears on two public blocklists (PhishDestroy, ScamSniffer). Gridinsoft assigns a trust score of 0/100, and the domain is listed on two additional security blocklists. While the exact content and credential‑capture mechanisms have not been publicly disclosed, the combination of a deceptive title, low trust score, and multiple vendor detections suggests a malicious intent to harvest user credentials or funds. Defenders should block the domain at network perimeter, add it to URL filtering and intrusion‑prevention rule sets, and monitor for any related traffic to the associated Cloudflare IP. Ongoing observation of the domain’s DNS and SSL attributes is recommended to detect potential changes.