eo-xodwa[.]pages[.]dev

Analysis of eo-xodwa.pages.dev confirms it as an active crypto drainer phishing domain, first registered on May 6, 2026. The domain resolves to IP address 188.114.96.3, hosted on Cloudflare infrastructure with nameservers dax.ns.cloudflare.com and meadow.ns.cloudflare.com. SSL certification is provided by Google Trust Services (WE1), and the site employs HSTS and HTTP/3 protocols. The domain currently returns an HTTP 200 status, indicating full operational capacity. It appears on at least one security blocklist and is flagged by 3 of 91 security vendors in VirusTotal scans, though the exact nature of detected threats remains unconfirmed. Infrastructure analysis reveals the domain is part of Cloudflare's Pages platform, a common vector for rapidly deployed phishing sites due to its free hosting and CDN capabilities. The scam type is explicitly classified as a crypto drainer, suggesting the site is designed to exploit cryptocurrency transactions or wallets. No specific brand impersonation is identified in available data, and the page title (eo-xodwa.pages.dev) does not reveal additional targeting details. Defenders should prioritize blocking this domain at DNS and network levels, as well as monitoring for associated IP addresses (188.114.96.3) and Cloudflare nameserver patterns. Given the domain's recent creation and active status, continued monitoring for related infrastructure (e.g., additional subdomains or redirect chains) is recommended. The absence of widespread detection does not indicate safety, particularly for crypto-related threats, which often evade initial scans.