eng-us-exedos-io[.]pages[.]dev

PhishDestroy identifies eng-us-exedos-io.pages.dev as an active crypto drainer campaign under investigation. This domain is designed to trick users into connecting crypto wallets and authorizing malicious transactions, resulting in direct asset theft. The threat is classified as a high-risk drainer due to its real-time operational status and targeting of digital asset holders.

This domain was flagged by PhishDestroy after detection on a single security blocklist and blocked by MetaMask for malicious behavior. It resolves to IP 188.114.96.3 and is registered via Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, which does not indicate legitimacy due to Cloudflare’s proxy usage. VirusTotal currently shows 12/95 detections, indicating it remains undetected by most antivirus engines. No creation date is visible due to Cloudflare’s WHOIS privacy protection, but the domain is actively resolving and operational. The absence of detections suggests this campaign is either newly deployed or using evasion techniques to bypass detection engines.

To mitigate risk, users should avoid interacting with eng-us-exedos-io.pages.dev entirely. Disable wallet connections on untrusted sites and verify domains using PhishDestroy before entering credentials or authorizing transactions. Block the IP 188.114.96.3 at the network level and report the domain to your wallet provider (e.g., MetaMask) to prevent further exploitation. Always use hardware wallets for high-value transactions and monitor wallet approvals via tools like revoke.cash. Stay vigilant for similar campaigns leveraging Cloudflare pages.dev subdomains.