thexqub[.]pages[.]dev

The domain thexqub.pages.dev is a generic phishing site targeting cryptocurrency users with a 'Wallet Verification' scam. It does not impersonate a specific brand or use a known drainer kit but poses an elevated risk by attempting to steal wallet credentials or private keys. The site is currently taken offline, though it was active long enough to be flagged by security vendors.

Technical indicators confirm the domain was registered through Cloudflare, Inc. on March 22, 2026, and resolved to the IP address 172.66.44.152, hosted by Cloudflare in California. At the time of analysis, 2 of 95 VirusTotal security vendors flagged thexqub.pages.dev as malicious, including alphaMountain.ai and LevelBlue. It appeared on one security blocklist (PhishDestroy) and was not flagged by Google Safe Browsing. The SSL certificate was issued by Google Trust Services (WE1), and the site employed technologies such as React, jsDelivr, HSTS, and Cloudflare. The observed page title was 'Wallet Verification,' and the domain used Cloudflare nameservers (uma.ns.cloudflare.com and yahir.ns.cloudflare.com). Gridinsoft assigned a trust score of 0/100.

Victims who interacted with thexqub.pages.dev should immediately revoke any token approvals granted to unknown contracts and transfer funds to a new wallet. Monitor transaction history for unauthorized activity and report the domain to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group. If credentials were entered, assume they are compromised and avoid reusing them. Crypto wallet users should enable hardware-based or multi-signature authentication where possible.