xrpetf[.]pages[.]dev

This domain, xrpetf.pages.dev, is flagged as a crypto credential theft operation targeting users through brand impersonation. Analysis of the page title, "XRPETF," indicates an attempt to mimic a legitimate cryptocurrency exchange-traded fund (ETF) or related financial service. The site likely solicits user credentials, such as wallet login details or private keys, under the pretense of offering investment opportunities or account verification. No direct evidence of a drainer kit was observed, but the infrastructure aligns with known credential harvesting tactics in the cryptocurrency sector. Infrastructure analysis reveals the domain resolves to the IP address 188.114.97.3, a Cloudflare-operated endpoint. The domain was registered through Cloudflare, Inc., with a creation date of April 18, 2024, suggesting recent deployment. Detection metrics indicate elevated risk: the domain is flagged by 3 out of 95 security vendors on VirusTotal and appears on two independent security blocklists. Additionally, it is actively blocked by PhishDestroy and ScamSniffer, further corroborating its malicious classification. The SSL certificate is issued by Google Trust Services, a common tactic to lend superficial legitimacy to phishing infrastructure. As of the latest assessment, xrpetf.pages.dev has been taken offline, likely in response to detection and reporting. However, the risk of reemergence remains elevated due to the low-cost, disposable nature of such domains. Users who interacted with the site are advised to revoke any exposed credentials, monitor wallet activity for unauthorized transactions, and verify the legitimacy of any cryptocurrency-related communications. Organizations should update blocklists to include the domain and associated IP to prevent future access attempts.