exosduswab-io[.]pages[.]dev

PhishDestroy identifies exosduswab.io.pages.dev as an active credential harvesting domain currently under investigation for generic phishing activities. This domain poses a direct threat to unsuspecting users by mimicking legitimate login portals to steal sensitive credentials. The threat remains active as of the latest analysis, with no confirmed takedown actions taken at this time. This domain was flagged by 4 of 95 VirusTotal vendors, indicating a low initial detection rate despite its malicious intent. It was registered through Cloudflare, Inc. and resolves to IP address 188.114.96.3. The domain operates under Google Trust Services' SSL certificate infrastructure, which may lend false credibility to potential victims. Notably, this infrastructure aligns with Cloudflare's Pages.dev service, a legitimate platform often exploited by threat actors to host phishing content under the guise of legitimate subdomains. Despite its current lack of detection, the combination of Cloudflare's infrastructure and Google's SSL trust scores creates a deceptive appearance of legitimacy. The investigation status remains under active review due to the domain's recent deployment and low initial detection rates. Users are strongly advised to avoid interacting with exosduswab.io.pages.dev or any associated links. Organizations should consider blocking IP address 188.114.96.3 and updating firewall rules to prevent access. If credentials or sensitive data have been entered, users should immediately change passwords and monitor accounts for suspicious activity. Reporting this domain to relevant cybersecurity platforms and internal security teams can help mitigate further propagation of this threat.