en-us-exedos-net[.]pages[.]dev

en-us-exedos-net.pages.dev is identified as an active phishing site impersonating Microsoft 365 login portals to harvest corporate credentials. The domain is currently engaged in a credential harvesting campaign, leveraging spoofed Microsoft branding to deceive users into submitting sensitive login details. This threat is classified as a generic phishing operation with a current status of active exploitation.

PhishDestroy identifies en-us-exedos-net.pages.dev as a confirmed credential harvesting domain. This domain was flagged by 7 of 95 VirusTotal vendors, indicating a lack of immediate detection despite its operational status. The domain resolves to IP address 172.66.47.162 and is registered through Cloudflare, Inc., utilizing Google Trust Services for SSL certificates. The infrastructure is hosted on Cloudflare Pages, a legitimate platform often abused for phishing due to its rapid deployment and masking capabilities. The absence of detections suggests a stealthy campaign, emphasizing the need for proactive monitoring and user awareness.

Current status confirms this domain remains active and undetected by traditional security measures. Users interacting with this domain risk unauthorized access to corporate or personal Microsoft 365 accounts, enabling follow-on attacks such as data exfiltration or lateral movement within compromised networks. To mitigate exposure, organizations and individuals should block traffic to 172.66.47.162 at the network perimeter and review DNS logs for resolutions to en-us-exedos-net.pages.dev. Immediate user education on verifying domain authenticity and reporting suspicious login pages is critical. Additionally, security teams should prioritize this domain for takedown requests via Cloudflare’s abuse channels, leveraging the 7/95 VirusTotal score as evidence of evasive tactics.