xa90p[.]pages[.]dev

The domain xa90p.pages.dev has been identified as a phishing resource specifically designed to impersonate Dex Tools, a legitimate cryptocurrency interface platform. This site targets users by presenting a fraudulent browser-based wallet integration interface, attempting to harvest credentials and private keys. As of the latest assessment, the domain has been taken offline, though prior activity indicates an elevated risk classification due to its deceptive functionality and infrastructure. Analysis indicates that this domain was flagged by 2 of 95 security vendors on VirusTotal, suggesting limited but confirmed detection. It was registered through Cloudflare, Inc., and resolved to the IP address 172.66.47.43, a Cloudflare-hosted endpoint commonly used for both legitimate and malicious content. The domain was created on May 20, 2026, a future date that may indicate falsified registration data or a placeholder entry. It appears on one security blocklist, and its Gridinsoft trust score is 0 out of 100, reinforcing its malicious classification. Technologies detected on the site include HSTS, Google Hosted Libraries, Google Font API, and Cloudflare infrastructure, which are frequently leveraged to lend an appearance of legitimacy to phishing pages. At present, xa90p.pages.dev is offline, though its prior operational status poses residual risks to users who may have interacted with it. Security teams are advised to monitor for related domains using similar naming conventions or infrastructure patterns. Users who accessed this domain are strongly recommended to revoke any connected wallet permissions, rotate credentials, and scan local systems for unauthorized access or malware. Organizations should update blocklists with this domain and its associated IP to prevent future exposure. The use of future-dated domain registration and Cloudflare hosting highlights the need for enhanced scrutiny of newly observed domains, particularly those impersonating financial or cryptocurrency platforms.