exp--edus-web3[.]pages[.]dev

The domain exp--edus-web3.pages.dev posed an elevated risk as a generic phishing threat, designed to deceive users into divulging sensitive information. Though currently offline, its recent activity and registration details indicate it was part of a broader credential harvesting campaign, likely impersonating educational or web3 platforms to lure victims.

Technical analysis reveals that the domain was created on March 12, 2026, and registered through Cloudflare, Inc., with an SSL certificate issued by Google Trust Services (WE1). It resolved to IP address 188.114.97.3 and was flagged by 3 out of 95 security vendors on VirusTotal, appearing on three separate security blocklists. The page title displayed "Suspected phishing site | Cloudflare," confirming that hosting providers had already intervened to take it offline.

Users should remain vigilant against similar domains mimicking education or web3 services. To stay protected, avoid clicking on unsolicited links, enable multi-factor authentication on all accounts, and verify any suspicious URLs using PhishDestroy's threat database. If credentials were entered on this site, change passwords immediately and monitor accounts for unauthorized activity.