loginxyz[.]pages[.]dev

PhishDestroy has analyzed the domain loginxyz.pages.dev and identified it as a brand impersonation threat targeting Ethereum. This domain is currently offline, but its recent activity and structure indicate a clear intent to deceive users. The site presented itself as a legitimate Ethereum authentication portal with the title 'Sign-In with Ethereum', a common tactic used to harvest credentials.

The domain was created on April 20, 2026, and registered through Cloudflare, Inc. It resolves to IP address 172.66.44.156, which is associated with Cloudflare's infrastructure. Security scans reveal that 1 out of 95 VirusTotal vendors flagged this domain as malicious, and it appears on at least 3 security blocklists. The SSL certificate was issued by Google Trust Services, adding a veneer of legitimacy. Despite these indicators, the domain's risk level remains elevated due to its targeted impersonation of a high-value brand like Ethereum.

Given that the domain is now offline, the immediate threat is reduced, but users should remain vigilant. PhishDestroy recommends avoiding any interaction with loginxyz.pages.dev or similar domains that request Ethereum credentials. If you have already entered information on such a site, change your passwords immediately and enable two-factor authentication. Always verify URLs before entering sensitive data, and report suspicious domains to security authorities.