official-exo-us-io[.]pages[.]dev

This domain, official-exo-us-io.pages.dev, is confirmed to host a crypto wallet drainer designed to exfiltrate digital assets by impersonating legitimate cryptocurrency platforms. The site employs social engineering tactics, including fake login portals and transaction prompts, to trick users into exposing private keys or signing malicious smart contracts. Infrastructure analysis reveals the use of Cloudflare hosting, which provides SSL encryption (Google Trust Services) and HTTP/3 support, lending an air of legitimacy to the fraudulent operation. The domain’s design mimics trusted crypto services, increasing the likelihood of successful deception among less cautious users. Technical indicators strongly support the classification of this domain as malicious. Registered through Cloudflare, Inc. on March 22, 2026, the domain resolves to the IP address 188.114.97.3 and has been flagged by three independent security blocklists, including MetaMask and PhishDestroy. Despite its recent creation, the domain has not yet been detected by VirusTotal’s scanning engines, showing 0 out of 95 detections. Additional red flags include a Gridinsoft trust score of 0/100 and the presence of HTTP Strict Transport Security (HSTS), a protocol often exploited by threat actors to evade interception and appear more credible. Users who have interacted with official-exo-us-io.pages.dev should take immediate action to mitigate potential losses. First, disconnect any active wallet sessions and revoke permissions for all connected decentralized applications (dApps) via blockchain explorers. Monitor wallet activity for unauthorized transactions and transfer remaining assets to a new, secure wallet. If private keys or seed phrases were entered on the site, assume full compromise and cease using the exposed wallet. Report the incident to relevant financial and cybersecurity authorities, and consider scanning local devices for malware, as some crypto drainers deploy secondary payloads to maintain persistence.