us-exoxds-webdoc[.]pages[.]dev

us-exoxds-webdoc.pages.dev is a recently activated site that masquerades as a secure document portal to steal login credentials or deliver malware. Victims are shown a convincing replica of a familiar cloud-doc service and prompted to ‘verify identity’ before accessing a supposed file. Behind the scenes, the page harvests entered credentials or silently installs a payload without the user noticing. Treat any interaction with this domain as a potential compromise until further evidence proves otherwise. This domain was flagged by PhishDestroy on 2024-05-22. It resolves to a Cloudflare-backed IP (188.114.97.3) and hides behind a Google Trust Services SSL certificate to appear legitimate. VirusTotal currently shows zero engines flagging it despite 95 scans, indicating it has flown under the radar so far. The registrar is Cloudflare, Inc., which is often abused for rapid domain churn. If you or anyone in your organization visited us-exoxds-webdoc.pages.dev, assume credentials entered on the page have been compromised. Immediately rotate passwords for the service being mimicked, enable multi-factor authentication, and scan the affected endpoint with updated antivirus tools. Report the incident to your security team and block the domain at your network perimeter to prevent further access.