xosdeusweb[.]pages[.]dev

The domain xosdeusweb.pages.dev was registered on March 09, 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 188.114.96.3, which belongs to ASN 13335 (Cloudflare, Inc.) and is geolocated in the United States. The site presents an SSL certificate issued by Google Trust Services under the WE1 profile, indicating a valid HTTPS connection despite the underlying malicious intent. Infrastructure analysis shows the domain is protected by Cloudflare’s edge services, employing HSTS and HTTP/3. The HTTP response returned a 403 status code at the time of observation, and the site was subsequently taken offline. The page title returned by the server is “Exodus Web3 Wallet | Secure & Manage Crypto,” which aligns with the reported scam type of wallet/seed phishing.

The known intelligence flags the domain as impersonating the brand “across” and specifically targets users of cryptocurrency wallets. Reputation checks reveal a Gridinsoft trust score of 0 out of 100, indicating a highly malicious assessment. VirusTotal analysis recorded 15 detections out of 94 scanned security vendors, confirming the presence of malicious indicators. The domain appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a high‑risk phishing vector.

Uncertainties remain regarding the exact content of the landing page, as the site is offline and no visual artefacts have been captured. The lack of a publicly available Safe Browsing verdict or OTX entry limits the ability to correlate additional threat‑intel, but the combination of a brand‑impersonating title, low trust score, multiple vendor detections, and blocklist listings provides sufficient evidence for a high‑severity rating. Defenders should add the domain and its associated IP address (188.114.96.