doe-exdusweb[.]pages[.]dev

PhishDestroy has identified the active phishing domain doe-exdusweb.pages.dev as a generic phishing threat currently under investigation for crypto drainer activity. This domain does not impersonate a specific brand but follows a pattern consistent with wallet-draining operations, designed to trick users into connecting malicious smart contracts or signing fraudulent transactions. The infrastructure is hosted on Cloudflare Pages, leveraging Google Trust Services SSL certificates to appear legitimate, which may lower user suspicion during initial interaction. This domain resolves to IP address 188.114.97.3 and currently shows 0 detections out of 95 engines on VirusTotal, indicating it remains undetected by most antivirus and security platforms. It is registered through Cloudflare, Inc., utilizing Cloudflare Pages for hosting, which provides anonymity and rapid deployment capabilities often exploited by threat actors. The domain’s SSL certificate, issued by Google Trust Services, adds a veneer of authenticity, while the lack of blocklist entries suggests it is newly active and still propagating across threat intelligence feeds. As of this report, the domain remains active and poses an ongoing risk to cryptocurrency users. PhishDestroy recommends immediate caution when encountering links to doe-exdusweb.pages.dev and advises users to verify any suspicious URLs using PhishDestroy’s real-time scanning tool. While the specific risk level is under investigation, the combination of zero detections, Cloudflare hosting, and potential drainer functionality warrants a high level of suspicion. Users are urged to avoid interacting with this domain and to report any suspicious activity to PhishDestroy for further analysis.