exesdeusweb[.]pages[.]dev

This domain, exesdeusweb.pages.dev, is identified as a crypto wallet drainer designed to siphon digital assets from victims' wallets. Analysis indicates the site employs deceptive transaction prompts or malicious smart contract interactions to trigger unauthorized transfers, a common tactic in cryptocurrency theft operations. The infrastructure is optimized for rapid deployment and evasion, targeting users who may be tricked into connecting their wallets to the site under false pretenses, such as fake airdrops or token swaps.

Evidence supporting this assessment includes detection by 4 out of 95 security vendors on VirusTotal, registration through Cloudflare, Inc. on March 23, 2026, and presence on 3 security blocklists. The domain resolves to the IP address 188.114.97.3 and utilizes technologies such as HSTS and HTTP/3, which are often leveraged to enhance perceived legitimacy. The SSL certificate is issued by Google Trust Services, further masking its malicious intent behind trusted infrastructure. Additional indicators include a Gridinsoft trust score of 0/100 and blocking by multiple security providers, confirming its classification as a high-risk threat.

Users who visited exesdeusweb.pages.dev or connected a wallet to the site should immediately revoke any active smart contract approvals, transfer remaining assets to a new wallet, and monitor transaction histories for unauthorized activity. It is recommended to scan the device used to access the site for malware, as crypto drainers may deploy additional payloads. If credentials or recovery phrases were entered, consider the compromised wallet permanently at risk and cease all interactions with it. Report the incident to relevant security teams and blocklist providers to aid in tracking the threat actor's infrastructure.