home-us-exoss[.]pages[.]dev

This domain is flagged as a high-risk credential theft phishing site targeting users through deceptive login interfaces. Analysis indicates the infrastructure was designed to mimic legitimate authentication portals, likely to harvest usernames, passwords, and session tokens for unauthorized account access or lateral movement within compromised networks. Infrastructure analysis reveals the domain was registered on September 11, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.44.93, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy. Security vendors on VirusTotal detect the domain at 17/95, and it appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The page title, 'Suspected phishing site | Cloudflare,' suggests the domain was either auto-flagged by hosting infrastructure or repurposed after initial detection. Mitigation steps for credential theft threats include immediate blacklisting of the domain and IP across all network security controls, including firewalls, email gateways, and endpoint protection systems. Organizations should enforce multi-factor authentication (MFA) for all critical accounts to mitigate the impact of stolen credentials. Security teams are advised to conduct a retrospective analysis of logs for connections to 172.66.44.93 or the domain, particularly from endpoints that may have interacted with the site prior to takedown. User awareness training should emphasize the risks of entering credentials on untrusted portals, even those appearing to use legitimate branding.