exod-uus-web3[.]pages[.]dev

This domain, exod-uus-web3.pages.dev, is identified as a crypto wallet drainer, a specialized phishing threat designed to deceive users into executing malicious smart contract transactions. The site impersonates legitimate decentralized application (dApp) interfaces, likely targeting cryptocurrency holders by prompting them to connect wallets and sign transactions that drain funds. No specific brand impersonation was confirmed, but the infrastructure aligns with known drainer kits used in previous campaigns. Analysis indicates the domain was registered through Cloudflare, Inc. and resolves to the IP address 172.66.47.166. It was created on March 10, 2026, though this date may reflect a falsified registration timestamp. The domain is flagged by 11 out of 95 security vendors on VirusTotal and appears on three independent blocklists. The SSL certificate is issued by Google Trust Services, and the site employs HTTP/3 and HSTS, likely to mimic legitimate services and evade basic detection mechanisms. No Google Safe Browsing (GSB) classification was provided, but the domain has been proactively blocked by multiple wallet security extensions. As of the latest assessment, exod-uus-web3.pages.dev has been taken offline, and Cloudflare has marked it as a suspected phishing site. Despite its current inactive status, the domain remains a high-risk indicator due to its prior use in crypto theft operations. Users who interacted with the site should revoke any wallet permissions granted during the suspected exposure period and monitor connected accounts for unauthorized transactions. The infrastructure and techniques observed suggest the operators may redeploy similar domains, warranting continued vigilance for lookalike URLs or related IP ranges.