web-us-exxdos[.]pages[.]dev

The domain web-us-exxdos.pages.dev was first registered on 21 February 2026 through Cloudflare, Inc. Its authoritative nameservers are mckenzie.ns.cloudflare.com and hugh.ns.cloudflare.com, and DNS resolution points to the IP address 172.66.47.93, which belongs to AS13335 Cloudflare, Inc. located in the United States. The site served a Cloudflare‑provided page titled “Suspected phishing site | Cloudflare” and returned an HTTP 403 response, indicating that the content was blocked by the edge service. TLS negotiation used a certificate issued by Google Trust Services under the WE1 identifier, confirming the presence of a valid SSL chain. Network‑level observations show the deployment of HTTP/3 and enforced HSTS, further confirming the use of modern Cloudflare infrastructure.

Security telemetry places the domain on three independent blocklists, specifically PhishDestroy, MetaMask, and SEAL, and VirusTotal records show that 11 of 93 scanned vendors flagged the domain as malicious. The Gridinsoft trust score of 0 out of 100 reinforces the assessment of a high‑risk payload. The listed scam type is credential phishing, suggesting that the site is intended to harvest user credentials, although the exact target brand or login page has not been disclosed in the available data. The available intelligence does not disclose which service or brand the credential collection aims at, so further analysis of the page content would be required if the site reappears.

Because the domain is currently offline, active exploitation cannot be confirmed at this moment, but the combination of blocklist listings, multiple vendor detections, a zero trust score, and the explicit “Suspected phishing site” page title provides strong evidence of malicious intent. Defenders should continue to block the domain at perimeter filters, update DNS blacklists, and monitor for any resurgence of activity from the associated IP address or related Cloudflare‑hosted subdomains.