offiicals-exous-oi[.]pages[.]dev

PhishDestroy identifies offiicals-exous-oi.pages.dev as an active credential-harvesting domain designed to trick users into surrendering login credentials under the guise of an official service page. The site employs deceptive naming conventions and structure to appear legitimate, typically targeting victims through phishing emails, social media links, or malicious ads. Once accessed, it may capture entered usernames and passwords, potentially exposing victims to account takeovers and further identity theft. This domain was flagged by PhishDestroy’s automated pipeline on seed ff9dbc, with zero detections on VirusTotal as of the time of analysis. The site resolves to IP 188.114.97.3 via Cloudflare’s network, utilizing a Google Trust Services SSL certificate to enhance perceived legitimacy. It was registered through Cloudflare, Inc., a common choice among threat actors seeking anonymity and fast deployment. While currently undetected by antivirus engines, its behavioral patterns and naming inconsistencies align with known credential-harvesting campaigns. If you visited offiicals-exous-oi.pages.dev, immediately change any passwords you may have entered and enable multi-factor authentication on all related accounts. Avoid reusing compromised credentials across different services. Scan your device using up-to-date antivirus software and monitor financial accounts for unusual activity. Report the domain to your IT team or through platforms like Google Safe Browsing to help disrupt ongoing campaigns.