xq[.]pages[.]dev

PhishDestroy identifies xq.pages.dev as an active generic phishing domain hosting a counterfeit login page designed to harvest crypto wallet credentials. The domain does not appear to deploy a known drainer kit but instead mimics a legitimate login interface to trick users into surrendering private keys or seed phrases. This tactic is commonly used to gain unauthorized access to digital assets across multiple blockchain networks.

This domain was flagged with a VirusTotal detection score of 0 out of 95 security engines as of the latest scan, indicating it remains undetected by most antivirus and threat intelligence platforms. It resolves to IP address 172.66.47.134, is registered through Cloudflare, Inc., and holds a valid SSL certificate issued by Google Trust Services. The domain was observed using a .pages.dev subdomain under Cloudflare Pages, a platform often abused for rapid deployment of spoofed sites. Additionally, PhishDestroy notes that this domain has not yet been added to major blocklists such as Google Safe Browsing (GSB) or PhishTank, leaving users vulnerable to first-time exposure.

As of the latest analysis, xq.pages.dev remains active and under investigation with a status classified as 'high risk' due to its clear intent to deceive. PhishDestroy has flagged the domain and is coordinating with hosting providers and security vendors for takedown. However, the absence of detections and blocklist coverage means the threat is still propagating across unsuspecting user networks. Users are strongly advised to verify any suspicious login pages using PhishDestroy’s real-time scanning tool before entering credentials. Until confirmed safe, interacting with this domain or its linked content poses a significant risk of credential theft and financial loss.