en-web3-exods--us[.]pages[.]dev

en-web3-exods--us.pages.dev — Web3 Phishing Investigation Report

PhishDestroy identifies en-web3-exods--us.pages.dev as a live Web3 wallet phishing domain actively impersonating a popular cryptocurrency ecosystem. The infrastructure is currently hosting a phishing campaign targeting users through deceptive Web3 wallet login pages designed to harvest private keys and seed phrases. The threat remains classified as active pending further behavioral analysis and evidence collection.

This domain was flagged by zero of 95 VirusTotal vendors at the time of initial analysis, indicating a low detection rate despite the high-risk nature of the content. The domain was registered via Cloudflare, Inc., resolving to IP address 188.114.96.3 and secured with a Google Trust Services SSL certificate. The infrastructure shows no prior blocklist presence, maintaining a pristine reputation across threat intelligence platforms. Historical domain registration data indicates recent creation, with no associated subdomains or known benign activity detected during preliminary reconnaissance.

Given the active status of this phishing campaign and the absence of vendor detection, immediate defensive actions are recommended. Security teams should block the domain at the DNS and network levels using the provided indicators. Users should be warned against interacting with any Web3 wallet login prompts originating from untrusted domains or unexpected sources. Continuous monitoring of this domain for behavioral changes and rapid indicator expansion is strongly advised to prevent successful compromise of user credentials and digital assets.