faq-exxchange-shadow-io[.]pages[.]dev

This domain, faq-exxchange-shadow-io.pages.dev, is actively being used for credential theft phishing. The site mimics a legitimate Shadow Exchange login page to trick users into providing their login credentials, which are then harvested by the attackers for unauthorized access to accounts.

Analysis indicates that faq-exxchange-shadow-io.pages.dev is flagged by 2 out of 95 security vendors on VirusTotal, suggesting that while the threat is recognized, it may still evade detection by some security solutions. The domain was created on April 11, 2026, and is registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, which may give a false sense of security to unsuspecting users. The IP address 188.114.97.3 is located in CA, but this is likely a front for the actual location of the attackers, as Cloudflare is known for providing CDN services.

If you have visited faq-exxchange-shadow-io.pages.dev, it is crucial to take immediate action to protect your credentials and account security. Change passwords for any accounts that may have been compromised, and enable two-factor authentication (2FA) where available. Monitor your accounts for any unauthorized activity and consider reporting the incident to your organization's IT security team. Additionally, avoid clicking on links or entering credentials on any unfamiliar or suspicious websites, and verify the URL and SSL certificate of any login page to ensure it is legitimate.