xyzverseio[.]pages[.]dev

This domain, xyzverseio.pages.dev, is flagged as an active credential theft operation targeting users through a fraudulent interface labeled XYZVerse. Analysis indicates the site is designed to harvest login credentials, likely through a spoofed authentication portal that mimics legitimate services. No direct association with known crypto drainer kits or financial transaction redirection has been observed, but the credential harvesting mechanism aligns with broader phishing infrastructure trends. Infrastructure analysis reveals the domain was registered on April 02, 2026, through Cloudflare Pages, a platform frequently exploited for rapid deployment of phishing sites. The domain resolves to IP address 188.114.96.3, located in Canada and associated with Cloudflare’s network. As of the latest scan, VirusTotal reports 0/95 detections, indicating no antivirus engines have flagged the domain at this time. The site appears on one security blocklist, specifically PhishDestroy, and uses an SSL certificate issued by Google Trust Services (WE1). Google Safe Browsing status remains unlisted, suggesting the domain has not yet been widely recognized as malicious. Current status shows the domain remains active, with no takedown or mitigation efforts observed. The low detection rate and absence of widespread blocklisting present a residual risk for users who may encounter the site through targeted distribution channels, such as email or social engineering campaigns. Organizations are advised to preemptively block the domain and associated IP at the network level. End users should verify the legitimacy of any login portal labeled XYZVerse, particularly those hosted on non-standard domains or third-party page builders. Monitoring for credential reuse across other platforms is recommended for any accounts exposed to this domain.