# xxlrain.pages.dev — SUSPICIOUS

> PhishDestroy identifies xxlrain.pages.dev as a fake 'warez' phishing scam. Blocked by ScamSniffer, it evades detection with 0/95 VirusTotal scans passed.

## Summary
PhishDestroy identifies xxlrain.pages.dev as a fraudulent site masquerading as a 'warez' or pirated content hub. This domain specifically targets users seeking unauthorized software, games, or media, using deceptive downloads to deliver malware or steal login credentials. The threat is confirmed active and currently under investigation by security teams.

This domain was flagged as a generic phishing scam by multiple security vendors, including Enkrypt and ScamSniffer. Intelligence shows it registered through Cloudflare, Inc., resolves to IP 172.66.47.116, and has already appeared on 2 security blocklists. Notably, VirusTotal records 0 detections out of 95 scans, indicating it evades traditional antivirus detection. The SSL certificate, issued by Google Trust Services, adds a false sense of legitimacy to phishing attempts.

Users who visited xxlrain.pages.dev should immediately scan their devices using reputable antivirus software. Avoid interacting with the site or downloading any files. If credentials were entered, change passwords immediately and enable two-factor authentication where possible. Report the domain to your browser’s security team or a trusted phishing reporting service to help block further access.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.47.116

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["Enkrypt", "ScamSniffer"]

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/735870c5-280f-496f-a8e6-3d2d55df7799
- PhishDestroy: https://phishdestroy.io/domain/xxlrain.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/xxlrain.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/xxlrain.pages.dev/
Last updated: 2026-03-23