rexas-bsw[.]pages[.]dev

The domain rexas-bsw.pages.dev is currently active and hosted on Cloudflare infrastructure, resolving to IP address 188.114.97.3, which is geolocated to Canada and associated with Cloudflare, Inc. The domain was registered on February 14, 2025 through Cloudflare Pages and presents a valid SSL certificate issued by Google Trust Services under the WE1 authority. An HTTP request returns a 200 status code and the page title "Rexas Finance - Rexas.com". Technical fingerprinting shows the presence of jsDelivr, cdnjs, crypto-js, HSTS, and HTTP/3, all typical of Cloudflare Pages sites. The site is listed on four security blocklists—PhishDestroy, MetaMask, SEAL, and ScamSniffer—and received a Gridinsoft trust score of 0/100, reinforcing its malicious classification. VirusTotal analysis indicates that 2 of 91 security vendors have flagged the domain, further supporting suspicion. While the observed page title suggests an attempt to impersonate a financial service, no additional content has been disclosed, leaving the exact phishing vector (e.g., credential collection, monetary theft) unconfirmed. Defenders should block network connections to rexas-bsw.pages.dev, add the domain to URL filtering policies, and monitor for related host or IP activity. Continuous re‑evaluation is advised should further intelligence on the payload or victim interaction emerge.