exosdueweb-io[.]pages[.]dev

PhishDestroy identifies exosdueweb-io.pages.dev as an active credential theft domain using brand impersonation via Cloudflare Pages to harvest user login details. The infrastructure is currently live and engaging in malicious activity, posing immediate risk to unsuspecting visitors. This domain is not a generic phishing page—it is a targeted credential harvesting campaign designed to mimic trusted login interfaces.

This domain was flagged by 2 of 95 VirusTotal vendors, indicating it has yet to be widely detected despite its active status. It is registered through Cloudflare, Inc., resolves to IP 188.114.97.3, and holds a Google Trust Services SSL certificate. The infrastructure is hosted on Cloudflare Pages and leverages HTTPS for legitimacy deception. With no current blocklist presence and uncompromised trust scores, it remains under active investigation but has already initiated credential theft operations.

Although current threat intelligence suggests low detection coverage, exosdueweb-io.pages.dev is confirmed active and should be treated as a high-risk credential theft domain. Users are advised to avoid this domain entirely, report it to their security teams or browser blocklists, and verify any login prompts against official sources. Network defenders should monitor for outbound connections to 188.114.97.3 and inspect DNS logs for resolution attempts. Immediate blocking at the firewall and endpoint levels is recommended to prevent credential exposure.