# xq.pages.dev — SUSPICIOUS

> PhishDestroy warns that xq.pages.dev impersonates a login portal to steal crypto wallet credentials. VirusTotal flags 0/95 engines; verify URLs on PhishDestroy.

## Summary
PhishDestroy identifies xq.pages.dev as an active generic phishing domain hosting a counterfeit login page designed to harvest crypto wallet credentials. The domain does not appear to deploy a known drainer kit but instead mimics a legitimate login interface to trick users into surrendering private keys or seed phrases. This tactic is commonly used to gain unauthorized access to digital assets across multiple blockchain networks.  

This domain was flagged with a VirusTotal detection score of 0 out of 95 security engines as of the latest scan, indicating it remains undetected by most antivirus and threat intelligence platforms. It resolves to IP address 172.66.47.134, is registered through Cloudflare, Inc., and holds a valid SSL certificate issued by Google Trust Services. The domain was observed using a .pages.dev subdomain under Cloudflare Pages, a platform often abused for rapid deployment of spoofed sites. Additionally, PhishDestroy notes that this domain has not yet been added to major blocklists such as Google Safe Browsing (GSB) or PhishTank, leaving users vulnerable to first-time exposure.  

As of the latest analysis, xq.pages.dev remains active and under investigation with a status classified as 'high risk' due to its clear intent to deceive. PhishDestroy has flagged the domain and is coordinating with hosting providers and security vendors for takedown. However, the absence of detections and blocklist coverage means the threat is still propagating across unsuspecting user networks. Users are strongly advised to verify any suspicious login pages using PhishDestroy’s real-time scanning tool before entering credentials. Until confirmed safe, interacting with this domain or its linked content poses a significant risk of credential theft and financial loss.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.47.134

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/01649f5d-24e8-4882-87d1-14abe33e2f1c
- PhishDestroy: https://phishdestroy.io/domain/xq.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/xq.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/xq.pages.dev/
Last updated: 2026-03-30