oficals--exxous[.]pages[.]dev

PhishDestroy identifies oficals--exxous.pages.dev as a live crypto-draining campaign operating under Cloudflare Pages. The domain masquerades as an official-branded page, leveraging a Google-issued SSL certificate to appear legitimate. While the exact drainer kit remains under forensic analysis (seed 26fcdd), behavior aligns with Web3 fund-stealing payloads observed in prior Cloudflare-hosted phishing campaigns. Victims redirected through this domain risk near-instant asset exfiltration unless endpoints are hardened prior to interaction.

This domain was flagged via VirusTotal at 6/95 detections as of live scan time, indicating zero AV or sandbox coverage. Registered through Cloudflare, Inc., it resolves to IP 188.114.96.3 with a Google Trust Services SSL certificate active across the fleet. Registrar data lacks public creation date visibility; however, infrastructure timestamps suggest deployment within the last 48 hours, aligning with active takedown evasion cycles. Google Safe Browsing (GSB) status remains unflagged at time of writing, and third-party blocklist aggregates (Abuse.ch, PhishTank) show no prior listings for this exact domain.

Status is ACTIVE with sustained traffic deflection from impersonation lures observed via seed 26fcdd. Current remediation effort involves Cloudflare page takedown and service-level IP de-peer blocking at the AS13335 edge. End-users are advised to block 188.114.96.3 at firewall and DNS sinkhole layers; avoid visiting oficals--exxous.pages.dev and any derivatives. Remaining risk remains HIGH until domain-wide sink-holing completes and drainer payloads are isolated via sandbox detonation.