xray-app-main-prod[.]pages[.]dev

Analysis of the domain xray-app-main-prod.pages.dev indicates that it is actively used in a crypto‑drainer phishing campaign. The site was registered on March 28, 2026 and is hosted behind Cloudflare, Inc., resolving to IP address 172.66.45.9, which is located in the Cloudflare network (CA). The page returns HTTP 200 and presents the title "XRAY — Cardano Super Wallet," suggesting an attempt to lure victims into interacting with a purported Cardano wallet interface. Technical fingerprints show the presence of WebAssembly, Ant Design, HSTS, and HTTP/3, all delivered via Cloudflare’s infrastructure. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Independent scoring from Gridinsoft assigns a trust score of 0/100, reinforcing the malicious classification. The known intelligence labels the activity as a "Crypto Drainer" and places the threat under investigation with a risk level of under_investigation. No additional content analysis is available beyond the page title; therefore, the exact phishing flow and credential collection mechanisms remain unverified. Defenders should prioritize adding the domain to deny‑list rules, monitor DNS queries for the same nameservers (ada.ns.cloudflare.com, aragorn.ns.cloudflare.com), and flag any traffic to the associated IP address. Continuous observation is recommended to capture any evolving payloads or credential harvesting pages that may be deployed under the same infrastructure.