z3x-withdraw[.]pages[.]dev

PhishDestroy identifies an active phishing campaign leveraging z3x-withdraw.pages.dev to impersonate a cryptocurrency withdrawal portal. This domain mimics legitimate withdrawal interfaces to deceive users into submitting private wallet keys or credentials, granting threat actors access to funds. The infrastructure relies on Google Trust Services for SSL certificates and resolves to IP 172.66.44.138, hosted by Cloudflare, Inc. as part of their Pages.dev platform.

This domain exhibits minimal detection with 0/95 VirusTotal detections, reflecting evasion tactics such as short-lived infrastructure or reliance on reputable hosting services. Registered through Cloudflare, Inc., the domain exploits Pages.dev’s dynamic DNS and free hosting to rapidly deploy and abandon campaigns, complicating takedown efforts. While the exact creation date remains unverified, the absence of blocklist entries suggests recent activation aligned with ongoing threat activity.

Users who interacted with this domain should immediately revoke any compromised credentials, transfer remaining assets to a new wallet, and scan devices for malware. Disable autofill features in browsers and enable two-factor authentication on all crypto accounts. Report fraudulent transactions to the relevant blockchain explorer and platform support teams using evidence such as transaction hashes or wallet addresses. Avoid clicking unknown links and verify URLs via official channels before entering sensitive information.