homepge-exudoa-web[.]pages[.]dev

PhishDestroy identifies homepge-exudoa-web.pages.dev as an active brand impersonation crypto drainer campaign targeting cryptocurrency users under seed a9e4b3. This Cloudflare Pages domain impersonates a legitimate service to deceive victims into connecting crypto wallets, where a drainer script silently siphons digital assets. The infrastructure lacks detection coverage and has not yet been flagged by security vendors despite active distribution.

This domain resolves to IP address 188.114.97.3 and operates under Cloudflare, Inc. registration with a Google Trust Services SSL certificate. VirusTotal shows 0 detections out of 95 engines as of latest scan, indicating zero detection coverage for this threat. The domain’s technical profile includes a generic registration footprint and leverages Cloudflare’s Pages service to host malicious content, making takedown and mitigation more complex due to Cloudflare’s abuse handling policies. No blocklist entries are currently recorded, and the domain remains active and accessible.

Current status indicates an active, undetected crypto drainer campaign with low detection sensitivity. Immediate action is required from security teams to block IP 188.114.97.3 and domain homepge-exudoa-web.pages.dev at network and endpoint levels. Cryptocurrency users should avoid interacting with any unsolicited links or domains purporting to offer services, especially those hosted on Cloudflare Pages. Remaining risk is HIGH due to zero detection, active distribution, and the irreversible nature of crypto asset theft. Continued monitoring and proactive blocking are essential to prevent further compromise.