cynextavlo[.]pages[.]dev

PhishDestroy identifies cynextavlo.pages.dev as an active malicious domain posing as a cryptocurrency investment platform while conducting credential harvesting and wallet drainer attacks. This false trading interface is designed to impersonate legitimate crypto services by exploiting Cloudflare Pages hosting under the .pages.dev TLD, a common tactic to bypass traditional domain-based security filters. The site leverages Google Trust Services SSL certificates and Cloudflare infrastructure to establish false legitimacy while delivering malicious payloads. This deployment strategy combines free hosting and trusted certificates to evade immediate detection by security tools.

This domain was flagged with 0/95 detections on VirusTotal, indicating it currently bypasses major antivirus engines despite active malicious behavior. Registered through Cloudflare, Inc., the domain resolves to IP address 188.114.97.3 and operates under Cloudflare's Pages service, which criminals increasingly exploit for rapid deployment of fraudulent crypto schemes. The combination of legitimate infrastructure with zero initial detections creates a particularly dangerous threat vector for cryptocurrency investors seeking legitimate trading opportunities.

If you visited cynextavlo.pages.dev and entered any cryptocurrency wallet credentials, immediately transfer all remaining assets to a new wallet and revoke any token approvals through wallet interfaces like Revoke.cash. If you used the same password across platforms, change those credentials immediately and enable two-factor authentication everywhere. Report the domain to your wallet provider and file incident reports with relevant authorities including your local cybercrime unit and the platform you intended to access.