trade-tanx-fi-referral[.]pages[.]dev

PhishDestroy identifies trade-tanx-fi-referral.pages.dev as a generic phishing domain active in a crypto drainer campaign. The site impersonates the Tanx.fi brand to steal cryptocurrency wallet credentials and drain funds. The threat type is generic_phishing, with high risk level, and it remains operational.

Technical indicators: VirusTotal score 2/95 security vendors flagging this domain; registrar is Cloudflare, Inc.; resolves to IP 172.66.46.232; SSL certificate issued by Google Trust Services / WE1; creation date not available; Google Safe Browsing status unspecified; blocklist count unknown. The domain uses a .pages.dev subdomain, which is a free Cloudflare Pages service, often abused for phishing. The unique seed a1f09f is used for tracking.

Current status: still active. PhishDestroy recommends immediate avoidance and reporting to Cloudflare. Users who have interacted should revoke wallet permissions and transfer assets to new wallets. Remaining risk is high due to the active nature and low detection rate. No response actions have been taken yet by hosting providers. Safety guidance: always verify URLs, enable 2FA, and use hardware wallets for crypto transactions.