docs-exo-web[.]pages[.]dev

The domain docs-exo-web.pages.dev was observed delivering a credential phishing campaign. The site presented the page title “Suspected phishing site | Cloudflare”, indicating that the content was flagged by Cloudflare’s own warning system. The domain was registered on February 21 2026 through Cloudflare, Inc. and uses Cloudflare’s DNS infrastructure, with authoritative name servers miki.ns.cloudflare.com and louis.ns.cloudflare.com. All traffic resolves to the IP address 188.114.96.3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming a legitimate‑looking HTTPS endpoint despite the malicious intent.

The server enforces HTTP Strict Transport Security and supports HTTP/3, typical of Cloudflare‑hosted services. When accessed, the HTTP response returned status code 403, and the site has since been taken offline. Independent analysis shows a Gridinsoft trust score of 0 / 100, reflecting extreme risk. Nine of ninety‑five VirusTotal scanners flagged the domain as malicious, and the host is listed on three external blocklists. Additionally, the domain is currently blocked by PhishDestroy, MetaMask, and SEAL, indicating that multiple protective services have recognized it as a threat.

The available evidence confirms a credential‑phishing operation, but the exact phishing vector, target brand, and payload details remain unknown because the page content has not been captured. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any residual connections to 188.114.96.3, and update threat‑intel feeds with the indicators of compromise (domain, IP, nameservers, SSL fingerprint). Organizations that use Cloudflare‑based services should verify that internal redirects do not inadvertently resolve to this address. Ongoing observation is recommended in case the actors reactivate the site under a different sub‑domain.