exosdeuswebs[.]pages[.]dev

PhishDestroy has flagged exosdeuswebs.pages.dev as an active crypto drainer under investigation. This domain poses a high risk due to its malicious design, which aims to deceive users into connecting cryptocurrency wallets and authorizing unauthorized transactions. The threat type is specifically a crypto drainer, a form of phishing that exploits wallet connection prompts to siphon digital assets without the victim’s awareness. At this stage, the domain remains undetected by 95 VirusTotal scanners (7/95 detections), highlighting the evasiveness of this threat and the need for proactive user vigilance. Given the absence of detections on widely used threat intelligence platforms, this domain may represent a newly deployed or highly obfuscated attack vector targeting the cryptocurrency community.

The domain exosdeuswebs.pages.dev resolves to IP address 172.66.44.83, which is consistently associated with Cloudflare infrastructure—a common choice for threat actors seeking to obscure hosting origins and evade takedown efforts. The domain is registered through Cloudflare, Inc., a legitimate registrar that unwittingly facilitates malicious actors through its proxy and CDN services. A Google Trust Services SSL certificate has been issued to the domain, which is not uncommon for phishing sites attempting to appear legitimate via HTTPS encryption. Currently, this domain is not listed on major blocklists, and comprehensive threat intelligence databases have not yet flagged its infrastructure. The combination of a fresh or stealthy deployment, lack of detections, and use of reputable infrastructure underscores a critical window of exposure where users remain vulnerable to exploitation.

To mitigate the risk posed by exosdeuswebs.pages.dev, users must exercise extreme caution when encountering links or advertisements promoting this domain, particularly in the context of cryptocurrency-related services. Never connect a wallet, enter private keys, or approve transactions on this site. Verify all URLs independently and use hardware wallets for high-value transactions to prevent unauthorized access. Report suspicious domains to your wallet provider, antivirus vendor, and platforms like VirusTotal to improve community detection. Website administrators should block the IP 172.66.44.83 and monitor network traffic for connections to this domain. Staying informed through threat intelligence feeds and practicing safe browsing habits are essential to combating emerging crypto drainer campaigns.