xellox-website[.]pages[.]dev

PhishDestroy identifies xellox-website.pages.dev as a generic phishing domain currently under investigation for malicious activity. This domain leverages Cloudflare Pages to host a deceptive interface, likely mimicking a legitimate service to harvest user credentials or sensitive data. No known drainer kit has been confirmed at this stage, but the threat remains active and evolving. This domain resolves to IP 172.66.44.199 and was registered through Cloudflare, Inc. with a Let’s Encrypt SSL certificate. VirusTotal reports 0/95 detections as of the latest scan, indicating no current AV or security vendor flagging. The domain’s age and registration details remain unverified, but its association with Cloudflare Pages suggests a low-cost, rapid deployment method favored by threat actors. No entry in Google Safe Browsing (GSB) or public blocklists has been recorded, leaving users exposed to potential exploitation. As of now, xellox-website.pages.dev remains active and unblocked across most threat intelligence platforms. Immediate user action is advised: avoid visiting the domain, report it to relevant authorities (e.g., browsers, phishing databases), and monitor for further IOCs. While the risk is currently labeled 'under_investigation,' the lack of detections and active status pose a latent threat to unwary users. Security teams should flag this domain in local blocklists and investigate any associated infrastructure for broader campaign links.