io-edgex-exchange[.]pages[.]dev

Analysis of io-edgex-exchange.pages.dev shows a high‑risk, active phishing infrastructure that targets the brand across through a wallet/seed collection scheme. The site returns HTTP 200 and serves a page titled “Edgex Exchange: Complete Beginner's Guide to Decentralized Trading,” indicating an attempt to lure users interested in decentralized finance. The domain is hosted behind Cloudflare, Inc., using the nameservers adi.ns.cloudflare.com, aisha.ns.cloudflare.com, bill.ns.cloudflare.com, and karl.ns.clo. Cloudflare’s presence is reinforced by the use of HSTS and HTTP/3, and the TLS certificate is issued by Google Trust Services under the WE1 identifier, confirming a valid SSL chain.

The domain resolves to IP 172.66.47.12, an address owned by AS13335 Cloudflare in the United States, a common hosting location for abuse‑hosting services. Registration data reveal the domain was created on September 02 2020 and remains registered through Cloudflare, suggesting the attacker benefits from the provider’s anonymity features. Reputation metrics are poor: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one security blocklist. PhishDestroy has already blocked the site, and three of ninety‑three VirusTotal scanners flagged it as malicious, reinforcing the suspicion of malicious intent.

The evidence confirms the domain is being used for wallet or seed phishing, impersonating the across brand, though the exact phishing page content has not been publicly disclosed. Defenders should block the domain at the DNS and proxy layers, monitor outbound connections to the associated IP, and add the host to internal blocklists. Continuous scanning with multi‑engine services is advised to capture any changes in payload or additional indicators of compromise.