# doc-xodus-web.pages.dev — SUSPICIOUS

> PhishDestroy identifies doc-xodus-web.pages.dev as a crypto drainer phishing site. 3/95 security vendors flagged this site resolving to 172.66.46.230.

## Summary
PhishDestroy flags doc-xodus-web.pages.dev at elevated risk as a crypto drainer phishing domain designed to steal cryptocurrency wallet credentials and initiate unauthorized transfers. This site employs deceptive tactics to trick users into connecting wallets under false pretenses, often impersonating legitimate crypto services or projects.  PhishDestroy's analysis confirms this domain was registered through Cloudflare, Inc. and resolves to IP 172.66.46.230, where it hosts a fraudulent interface. The domain carries a Google Trust Services SSL certificate, which attackers often exploit to appear legitimate. VirusTotal reports 3 out of 95 security vendors have flagged this domain for malicious activity, indicating limited but notable detection. Despite its recent appearance, this site already exhibits behavior consistent with crypto drainers, such as redirecting users to wallet connection prompts and initiating unauthorized blockchain transactions.  Users should avoid interacting with this site entirely. If you have already visited or connected a wallet, disconnect immediately and revoke any unauthorized connections through your wallet's security settings. Review transaction histories for suspicious outbound transfers and consider transferring remaining assets to a newly generated wallet address. Always verify URLs and use PhishDestroy’s real-time scanner or trusted security tools before engaging with crypto-related websites to prevent asset loss.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.46.230

## Detection Status
- VirusTotal: 3 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/021a2539-70ae-4ff7-9df2-f771c8c12b16
- PhishDestroy: https://phishdestroy.io/domain/doc-xodus-web.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/doc-xodus-web.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/doc-xodus-web.pages.dev/
Last updated: 2026-03-22