xcn-coin-news20250217[.]pages[.]dev

PhishDestroy has flagged xcn-coin-news20250217.pages.dev as an active crypto drainer campaign hosted under Cloudflare Pages. This domain mimics legitimate cryptocurrency news sites to deceive users into connecting wallets or entering seed phrases, which are then drained by attackers. The page displays a fabricated countdown clock and fake token airdrop claims to rush victims into making impulsive decisions. Security tools have not yet flagged this domain, leaving users vulnerable without prior awareness. This domain was registered via Cloudflare, Inc. and first appeared on February 17, 2025. It currently resolves to IP 172.66.44.197 and holds a valid SSL certificate from Google Trust Services, adding false legitimacy. VirusTotal shows 0 detections across 95 scanners, indicating early-stage deployment and low detection coverage. The combination of fresh registration, cloud hosting, and zero detections makes this a high-risk threat vector for cryptocurrency users. If you visited this page, disconnect your wallet immediately and revoke any connected permissions through your wallet's interface. Do not enter any private keys or seed phrases. Scan your device using reputable antivirus software and consider transferring funds to a clean wallet. Report the domain and any suspicious transactions to your wallet provider and relevant cybersecurity platforms.