doc-web3-exxodus[.]pages[.]dev

PhishDestroy identifies doc-web3-exxodus.pages.dev as an active crypto-drainer domain under forensic review. The site impersonates legitimate Web3 interfaces to trick users into connecting crypto wallets and signing malicious transactions that silently drain assets. Security telemetry and behavior analysis indicate this is a modern crypto-drainer kit designed to harvest private keys, seed phrases, and authorization signatures via deceptive Web3 prompts. No specific brand is being impersonated in the observed payloads; instead, the page presents generic Web3 login interfaces to cast a wide net across multiple ecosystems. Technical artifacts suggest the drainer leverages Web3 wallet interaction libraries to forge transaction approvals, commonly targeting Ethereum, Solana, and EVM-compatible chains. The domain is currently resolving to 188.114.97.3 across Cloudflare’s global CDN, indicating infrastructure leveraging reputable providers to evade early detection. This domain was flagged with 0 detections out of 95 engines on VirusTotal at the time of analysis, indicating it remains undetected by most antivirus and threat intelligence platforms. It is registered via Cloudflare, Inc., uses a Google Trust Services SSL certificate, and resolves to IP 188.114.97.3. The domain is hosted on Cloudflare Pages, a legitimate platform repurposed to serve malicious content. As of now, no public blocklist entries have been recorded, and the domain appears to be newly registered or recently activated given its low detection footprint. Google Safe Browsing (GSB) has not yet flagged the domain, and no prior incident correlation exists in major threat feeds. The combination of zero detections, Cloudflare hosting, and HTTPS suggests a deliberate strategy to delay blacklisting while targeting security-conscious crypto users. The domain remains active and responsive, with live content serving crypto wallet connection prompts and transaction simulation interfaces. PhishDestroy has issued a real-time threat advisory and is collaborating with domain registrars and hosting providers to facilitate takedown. Users are strongly advised not to connect wallets or interact with any page under doc-web3-exxodus.pages.dev. While the immediate risk is elevated due to low detection, the infrastructure’s reliance on Cloudflare may delay removal. All crypto users should verify URLs via official channels, disable auto-connect features in wallets, and monitor transactions for unauthorized transfers. Remaining risk is assessed as high until the domain is globally blocked and content is purged.