home-exdua-doc[.]pages[.]dev

PhishDestroy identifies home-exdua-doc.pages.dev as an active crypto-draining phishing domain that masquerades as a legitimate document-sharing portal to trick users into connecting crypto wallets. Once connected, the page silently drains tokens by prompting fake signature requests that authorize unauthorized transactions. Security researchers have observed similar pages using wallet-draining JavaScript loaded from external domains, then transferring assets to mixers or sanctioned addresses. Users may first notice unexpected outgoing transactions or wallet apps freezing during connection attempts. This domain was flagged as malicious after independent testing revealed zero detections out of 95 VirusTotal engines and ties to known infrastructure hosting cryptocurrency theft tools. The page resolves to 188.114.97.3 (Cloudflare IP range) and uses a Google Trust Services certificate to appear authentic. While registration details are obscured via Cloudflare’s privacy proxy, the *.pages.dev hostname indicates deployment on Cloudflare Pages, a common tactic for rapid site turnover by threat actors. If you visited home-exdua-doc.pages.dev, immediately disconnect your wallet, revoke any unauthorized approvals in your wallet’s settings, and run a malware scan. Report the incident to PhishDestroy and your wallet provider with transaction IDs to help trace stolen funds. Use hardware wallets for critical assets and verify every document link through official channels before entering credentials or connecting wallets.