eng-us-exedos-wallat[.]pages[.]dev

PhishDestroy identifies eng-us-exedos-wallat.pages.dev as an active crypto wallet drainer kit impersonating legitimate wallet services. This domain employs a sophisticated fake interface designed to trick users into connecting their wallets, leading to immediate fund extraction. The kit is hosted on Cloudflare Pages, leveraging the reputable platform to evade traditional domain-based detection mechanisms.

This domain resolves to IP 172.66.47.189 and is registered through Cloudflare, Inc., with a Google Trust Services SSL certificate adding superficial legitimacy. VirusTotal currently reports 9/95 detections, indicating it has not yet been flagged by security vendors despite its malicious nature. The domain's recent deployment and lack of blacklist entries suggest it is in an early operational phase, with threat actors likely testing its efficacy before broader deployment. The absence of detections, combined with its use of a legitimate cloud provider, raises concerns about its potential to evade automated defenses.

As of the latest assessment, eng-us-exedos-wallat.pages.dev remains active and under investigation, with the risk level categorized as 'under_investigation.' No known blocklist entries or takedown actions have been recorded, leaving users exposed to potential attacks. Immediate recommendations include blocking the domain and IP at the network level, avoiding any interactions with the site, and educating users about the risks of wallet drainer kits. While the current threat is active, the lack of detections and early-stage deployment suggest that proactive measures could mitigate further spread. Remaining risk is moderate to high, contingent on the domain's continued operation and potential expansion to other platforms.