xxx-11g[.]pages[.]dev

This domain, xxx-11g.pages.dev, is currently under investigation for hosting a crypto drainer scam targeting users under the guise of 'Yona Cash,' as indicated by the page title. Infrastructure analysis reveals the domain was registered on March 27, 2026, through Cloudflare Pages and resolves to IP 172.66.44.236, associated with Cloudflare, Inc. in Canada. The domain remains active, returning an HTTP 200 status, and is flagged on at least one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious domains. While the domain has been scanned by 94 vendors on VirusTotal, none currently detect it as malicious, though this absence does not confirm safety. The scam type is explicitly classified as a crypto drainer, suggesting it aims to illicitly transfer cryptocurrency from victims' wallets. Defenders should treat this domain as high-risk due to its active status, confirmed scam classification, and association with phishing infrastructure. Blocking or monitoring traffic to this domain is recommended, particularly in environments where cryptocurrency transactions occur. Further analysis of the site's content and behavior is necessary to determine additional indicators of compromise or attack vectors.