xvinfooapas[.]pages[.]dev

PhishDestroy identifies xvinfooapas.pages.dev as an active crypto drainer scam leveraging Cloudflare Pages to impersonate a legitimate service. This domain is designed to trick users into connecting cryptocurrency wallets, leading to unauthorized fund transfers under the guise of a legitimate transaction. The threat type is classified as a generic_phishing campaign with a high risk of financial loss due to its wallet-draining functionality. No specific drainer kit has been identified yet, but the domain's structure and use of Cloudflare Pages suggest a template-based or kit-based deployment typical of opportunistic scammers.

This domain resolves to IP 188.114.97.3, registered through Cloudflare, Inc., and holds a valid SSL certificate issued by Google Trust Services. VirusTotal currently reports 0/95 detections, indicating it is not yet flagged by most antivirus engines. The domain was created recently, though the exact creation date is not publicly available. This domain has not been listed on Google Safe Browsing (GSB) as of the latest check, and no blocklist counts are available at this time. The use of Cloudflare's infrastructure and a Google-issued SSL certificate suggests an attempt to appear legitimate and evade detection through trusted services.

This domain remains active as of the latest investigation, with no confirmed takedown or blacklisting actions taken. PhishDestroy has flagged this domain under seed 34eedb for further analysis, and users are advised to avoid interaction until a conclusive risk assessment is completed. The remaining risk is high due to the potential for undetected financial theft via cryptocurrency drainers. Immediate action includes monitoring for updates, reporting to relevant authorities, and advising users to verify any suspicious links using PhishDestroy's tools before proceeding with transactions.