exoxdusweb-docs[.]pages[.]dev

Analysis of exoxdusweb-docs.pages.dev indicates a credential phishing operation that was taken offline prior to this assessment. The domain was registered on March 22, 2026 through Cloudflare, Inc., and its authoritative nameservers are kristin.ns.cloudflare.com and sean.ns.cloudflare.com, confirming the use of Cloudflare's DNS infrastructure. DNS resolution points to IP address 172.66.45.23, which belongs to Cloudflare's network in Canada, reinforcing the hosting attribution. The site presented a Cloudflare‑issued SSL certificate signed by Google Trust Services (WE1), and HTTP responses returned a 403 status code, suggesting the page is currently inaccessible.

The page title returned by the server reads "Suspected phishing site | Cloudflare," which aligns with the credential phishing classification provided in the intelligence feed. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, indicating extreme risk. The domain appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, demonstrating that multiple defensive platforms have already flagged it. VirusTotal scans show four of ninety‑four security vendors flagging the domain, providing additional confirmation of malicious intent.

Detected technologies include HSTS, Cloudflare's edge services, and HTTP/3, all typical of legitimate Cloudflare‑protected sites but also leveraged by threat actors to obscure origin. The precise phishing payload, target brand, or compromised credentials have not been disclosed, leaving the exact victim profile uncertain. Defenders should continue to block the domain at perimeter filters, update threat intel feeds with the observed indicators, and monitor for any re‑registration attempts or similar subdomains that resolve to the same Cloudflare IP range.