# learn-exodesweb3wallet.pages.dev — MALICIOUS

> Avoid learn-exodesweb3wallet.pages.dev, a high-risk crypto drainer domain. This phishing site is currently offline but was flagged for malicious activity.

## Summary
PhishDestroy identifies learn-exodesweb3wallet.pages.dev as a high-risk crypto drainer domain designed to steal cryptocurrency assets. The threat level is elevated due to its malicious intent targeting Web3 wallet users.

The domain was created recently on February 21, 2026, and registered through Cloudflare, Inc. It resolved to IP 172.66.47.148 and was detected on one security blocklist. VirusTotal flags this domain by 14 out of 95 security vendors, indicating a significant risk. The page title indicated a suspected phishing site on Cloudflare's warning page.

Currently, the domain has been taken offline, reducing immediate risk. Users are advised to avoid interacting with this domain and ensure their wallets and credentials remain uncompromised. Continuous monitoring is recommended to detect any resurgence or related threats.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.47.148
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["paul.ns.cloudflare.com", "christina.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 14 vendors flagged
  Vendors: ["ADMINUSLabs", "Criminal IP", "alphaMountain.ai", "BitDefender", "CyRadar", "ESET", "Forcepoint ThreatSeeker", "Fortinet", "G-Data", "Kaspersky", "Lionic", "Sophos", "VIPRE", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019ce53f-d27e-773c-930c-ba0e74476aa8.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/445fffe0-42fe-4810-a2fa-66134ef7668c
- PhishDestroy: https://phishdestroy.io/domain/learn-exodesweb3wallet.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/learn-exodesweb3wallet.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/learn-exodesweb3wallet.pages.dev/
Last updated: 2026-03-19