exxo-dus-webdoc[.]pages[.]dev

Analysis indicates that the domain exxo-dus-webdoc.pages.dev was registered on February 21 2026 and is hosted behind Cloudflare’s network (AS13335). The authoritative nameservers chloe.ns.cloudflare.com and finley.ns.cloudflare.com resolve the domain to IP 172.66.47.175, a location in the United States. The site returned an HTTP 403 response and the page title reported by the server is “Suspected phishing site | Cloudflare”, which matches Cloudflare’s default block page. The SSL certificate presented is issued by Google Trust Services under the “WE1” label, confirming the use of a valid TLS certificate despite malicious intent.

Security telemetry shows that ten of ninety‑three VirusTotal scanners have flagged the domain, and three independent blocklists—PhishDestroy, MetaMask, and SEAL—have already listed it. The domain received a Gridinsoft trust score of 0 out of 100, indicating a highly untrusted reputation. Detected technologies include HSTS, Cloudflare edge services, and support for HTTP/3, suggesting the attacker leveraged modern web protocols to improve performance and evade simple network‑level detection. The threat is classified as credential phishing, implying the infrastructure is likely used to harvest login credentials for targeted services.

The current public status is “taken offline”, which may be a temporary takedown or a deliberate removal after detection. At present, no payload samples or phishing landing pages have been publicly released, so the specific credential targets and any associated malware remain uncertain. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑registration of the same sub‑domain pattern, and enforce strict TLS inspection policies to detect similar Cloudflare‑proxied phishing sites.