web-doe-exdus[.]pages[.]dev

PhishDestroy identifies the domain web-doe-exdus.pages.dev as hosting a generic phishing attack currently under investigation and marked as active as of seed 0daee4. This domain does not impersonate a specific brand but follows a generic phishing pattern aimed at deceiving users into disclosing sensitive information. The threat level remains under investigation, but the site is active and poses a credible risk to visitors.

This domain was flagged by 17 of 95 VirusTotal vendors at the time of analysis, indicating it has evaded immediate automated detection despite its suspicious nature. It is registered through Cloudflare, Inc., and resolves to IP address 172.66.46.254, which is hosted on Google Trust Services SSL infrastructure. Resolving this IP leads to a Cloudflare Pages deployment environment, a legitimate service that has been abused to host malicious content. The infrastructure and SSL certificate suggest an attempt to appear legitimate, leveraging trusted providers to bypass security filters.

Given the active status and the use of trusted hosting infrastructure, users should treat web-doe-exdus.pages.dev as a confirmed phishing host. Avoid accessing this domain entirely. Report the domain to your browser vendor, network administrator, and security communities such as PhishTank or Google Safe Browsing. Consider updating your DNS sinkhole or blocklist with the IP 172.66.46.254 and domain web-doe-exdus.pages.dev immediately. Exercise heightened caution with any site using Cloudflare Pages for user-generated or externally submitted content, as these services are frequently exploited in phishing campaigns. Always verify URLs manually and use multi-layered security tools including browser-based phishing protection and endpoint detection.