exosd-us-web-io[.]pages[.]dev

PhishDestroy identifies exosd-us-web-io.pages.dev as an active financial-sector phishing domain engaged in credential harvesting. Operators are currently harvesting user credentials under the guise of a legitimate US financial services portal, and the domain remains unblocked by most vendors. The infrastructure leverages Cloudflare Pages for rapid deployment and abuse evasion, while retaining Google Trust Services certificates to enhance appearance of legitimacy. This domain was flagged by 8 of 95 VirusTotal vendors at the time of discovery. It was registered through Cloudflare, Inc., resolved to 172.66.47.62, and presented a Google Trust Services SSL certificate. The domain is newly observed and therefore has no historical blocklist presence; trust scores remain neutral as no automated detection has yet flagged the payload. Its genesis aligns with the seed identifier 29bc08, indicating a focused campaign rather than opportunistic abuse. The threat remains ACTIVE and under continuous investigation. Users are advised to avoid clicking any links from unsolicited messages referencing US financial services and to treat exosd-us-web-io.pages.dev as malicious until further notice. Security teams should block the IP 172.66.47.62 and the domain at the network perimeter and DNS level. Since the payload is still evolving, behavioral monitoring for anomalous authentication attempts is strongly recommended.