en-us-exedoss[.]pages[.]dev

The domain en-us-exedoss.pages.dev is currently flagged by Google Safe Browsing for social engineering, indicating that the URL is associated with attempts to deceive users into revealing credentials or personal information. The domain appears on a single security blocklist and is actively blocked by PhishDestroy, a service that intercepts known phishing resources. Technical resolution shows the domain uses Cloudflare’s DNS infrastructure, with authoritative name servers julissa.ns.cloudflare.com and leo.ns.cloudflare.com, and resolves to the IP address 172.66.45.4.

Registration details reveal the domain was provisioned through Cloudflare, Inc., a common provider for both legitimate and malicious actors, offering no intrinsic reputation signal. VirusTotal reports that the domain has been examined by 91 antivirus and scanning vendors, none of which returned a detection at the time of analysis; this absence of detections should not be interpreted as confirmation of safety, but it does indicate that the payload or hosting patterns have not yet triggered known signatures. No additional intelligence such as page title, SSL certificate details, or HTTP response codes is presently available, leaving the exact content and lure technique unverified.

Given the confirmed Safe Browsing flag, blocklist presence, and active blocking by PhishDestroy, defenders should treat the domain as malicious. Recommended mitigation steps include adding the domain to internal deny lists, ensuring that web filtering solutions enforce the block, and monitoring for any outbound connections to the hosting IP 172.66.45.4. Continuous re‑evaluation is advised, as changes in hosting or content could alter the risk profile.