docexdus-web[.]pages[.]dev

The domain docexdus-web.pages.dev has been identified as a high-risk generic_phishing site, primarily used for fake login attempts. The site does not appear to be associated with any specific brand or drainer kit, but its infrastructure and behavior suggest it is part of a broader phishing campaign designed to capture user credentials and personal information.

Analysis indicates that the domain has a VirusTotal detection score of 12/95, suggesting that a significant number of security vendors recognize the threat. The domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.45.33. It was created on March 11, 2026, and is currently listed in Google's Safe Browsing (GSB) as a suspected phishing site. The domain appears on three known security blocklists and is blocked by MetaMask, PhishDestroy, and SEAL. The Gridinsoft trust score for this domain is 0/100, indicating a complete lack of trustworthiness.

The domain is currently offline, which suggests that it has been taken down or is no longer actively being used for phishing activities. However, the infrastructure used, including the SSL certificate from Google Trust Services, HSTS, and Cloudflare, indicates a sophisticated setup aimed at evading detection and gaining user trust. Despite the offline status, the domain remains a significant risk due to its high detection count and low trust score. Security researchers recommend continued monitoring and updating of blocklists to ensure that users are protected against any potential future use of this domain.