officals-exo-us[.]pages[.]dev

Analysis of officals-exo-us.pages.dev shows a credential phishing infrastructure that was active as of the report date, July 24, 2026, but is currently taken offline. The domain was registered through Cloudflare, Inc. on March 22, 2026 and resolves to the Cloudflare edge address 172.66.44.60, located in Canada. DNS services are provided by corey.ns.cloudflare.com and mimi.ns.cloudflare.com, indicating reliance on Cloudflare's authoritative name servers. The site served over HTTPS with a Google Trust Services / WE1 certificate and enforced HTTP Strict Transport Security (HSTS) and HTTP/3, consistent with Cloudflare's performance stack.

The page title returned by the server reads "Suspected phishing site | Cloudflare" and the HTTP response code is 403, suggesting the page is blocked or inaccessible. Independent scanning on VirusTotal recorded 7 detections out of 94 security vendors, confirming malicious classification. The domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its identification as a phishing threat. Gridinsoft assigned a trust score of 0 out of 100, further indicating a high confidence of abuse.

While the current offline status limits immediate exposure, the underlying infrastructure—shared Cloudflare IP space and persistent domain registration—could be reactivated or leveraged for future campaigns. Defenders should continue to monitor the domain's DNS resolution, add the domain to local blocklists, and enforce network-level filtering of traffic to the associated IP address. Ongoing vigilance is recommended, as the hosting environment permits rapid re‑deployment of malicious pages without altering the underlying domain registration.