web3restore[.]pages[.]dev

This domain, web3restore.pages.dev, is identified as a cryptocurrency wallet phishing site targeting users with a fraudulent Multiverse Deep Sync interface. Analysis confirms the domain is actively serving phishing content designed to harvest wallet credentials under the guise of multiverse wallet support. The page title, 'Multiverse Deep Sync - One wallet, multiverse support,' suggests an attempt to impersonate legitimate cryptocurrency wallet services, though no specific brand is explicitly named in the available data. Infrastructure analysis reveals the domain was registered on June 07, 2026, through Cloudflare Pages. It resolves to the IP address 172.66.47.180 and is secured with an SSL certificate issued by Google Trust Services (WE1). The domain is flagged by 13 of 95 security vendors on VirusTotal and appears on three distinct security blocklists. Additional detections include blocking by multiple domain reputation systems, further confirming its malicious classification. As of the latest assessment, web3restore.pages.dev remains active and continues to pose a high risk to users. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to prevent access. Users who may have interacted with the site should immediately revoke any wallet permissions, transfer assets to a secure wallet, and monitor for unauthorized transactions. Security teams should treat this domain as a confirmed phishing resource and prioritize its inclusion in threat intelligence feeds.