exdusweb-us[.]pages[.]dev

PhishDestroy identifies exdusweb-us.pages.dev as an active crypto drainer phishing domain under investigation with a generic phishing threat type. This Cloudflare-hosted domain resolves to IP 172.66.47.98 and leverages a Google Trust Services SSL certificate for deceptive legitimacy. The domain is currently flagged by 0 out of 95 VirusTotal security vendors and is registered through Cloudflare, Inc. as part of an ongoing campaign targeting cryptocurrency users.

Technical analysis reveals this domain was created recently and has not yet been widely flagged by threat intelligence platforms. The domain exdusweb-us.pages.dev currently operates without detection on VirusTotal despite its malicious intent. The infrastructure relies on Cloudflare's Pages.dev service, which is frequently abused for phishing campaigns due to its legitimate appearance and free hosting structure. The SSL certificate issued by Google Trust Services adds a veneer of authenticity, reducing user suspicion in credential or crypto wallet theft attempts. Current blocklist counts remain at zero, indicating an early-stage or stealthy deployment.

The current status of exdusweb-us.pages.dev is active and under investigation, presenting an immediate risk for cryptocurrency drainer operations. PhishDestroy recommends blocking this domain at the network level and advising users to avoid interactions. Organizations should inspect DNS logs for connections to 172.66.47.98 and monitor for associated wallet addresses. Users must ensure they validate URLs via official sources and use browser extensions that detect crypto drainer domains. Immediate action is required due to the undetected status and potential for widespread exploitation.