en-s-exedos[.]pages[.]dev

PhishDestroy identifies en-s-exedos.pages.dev as an active brand impersonation scam site currently under investigation for credential theft activities. The domain leverages Cloudflare Pages hosting to mimic legitimate services, deceiving users into surrendering sensitive login credentials. This threat remains active and is being tracked under unique seed 887e56 for rapid takedown coordination.

This domain was flagged by 0 of 95 VirusTotal vendors, indicating it has not yet been widely detected despite its malicious intent. The domain is registered through Cloudflare, Inc., resolving to IP address 172.66.44.232 and secured with a Google Trust Services SSL certificate. While creation details remain unverified in public records, the absence of VirusTotal detections suggests either a newly deployed campaign or one carefully evading signature-based detection mechanisms. Current trust scores and additional blocklist data remain unavailable at this time.

Given the confirmed active status, users are strongly advised to avoid interaction with en-s-exedos.pages.dev and report any encountered credentials submitted to this domain. Organizations should implement DNS filtering to block access to 172.66.44.232 and monitor for associated IOCs in network traffic. Immediate takedown requests should be submitted to Cloudflare Trust & Safety using the domain and IP as evidence. The public is urged to verify URLs through official channels before entering any credentials or sensitive data.