exodasweb-us[.]pages[.]dev

PhishDestroy identifies exodasweb-us.pages.dev as an active Microsoft support scam domain currently under investigation for phishing activities. The domain is operational and remains unresolved, indicating ongoing abuse with potential risk to unsuspecting users. This advisory highlights critical indicators for immediate detection and mitigation.

This domain was flagged by 2 of 95 VirusTotal vendors at the time of analysis, indicating a low initial detection rate despite its malicious activity. exodasweb-us.pages.dev is registered through Cloudflare, Inc., resolves to IP 188.114.96.3, and uses a Google Trust Services SSL certificate. The domain is part of the Pages.dev subdomain service, which may facilitate rapid rotation and evasion techniques. Additional telemetry suggests a limited presence on public blocklists, increasing the likelihood of undetected exposure to end users.

The domain remains active and poses an evolving threat due to its misuse of legitimate infrastructure (Pages.dev and Cloudflare). Users should avoid interacting with exodasweb-us.pages.dev and report any encounters to their security teams. Security teams are advised to block the domain at the network level, monitor for related artifacts (e.g., IP 188.114.96.3, SSL certificate serial), and update detection rules accordingly. Further investigation is warranted to identify associated campaigns and infrastructure.