moz-extension3dc72401-11c6-4434-981c-66ae6ce00a05app[.]pages[.]dev

The domain moz-extension3dc72401-11c6-4434-981c-66ae6ce00a05app.pages.dev is currently active and poses a high-risk generic phishing threat, specifically impersonating the Xverse Wallet brand to steal user credentials and sensitive information. This malicious domain was created on May 23, 2026, and remains operational, making it an immediate danger to anyone who encounters it.

Technical analysis reveals several red flags. The domain resolves to IP address 188.114.97.3 and is registered through Cloudflare, Inc., a common registrar for both legitimate and malicious sites. VirusTotal data shows that 1 out of 95 security vendors flag this domain as malicious, indicating low but present detection. It also appears on one security blocklist. The SSL certificate is issued by Let's Encrypt (E8), which is free and easily obtained, offering no assurance of legitimacy. The page title explicitly claims to be "Xverse Wallet," a clear attempt to deceive users.

Given the active status and high risk level, users should avoid any interaction with this domain. Do not enter any personal or financial information, and never download files from it. If you have already visited the site, change your passwords immediately and enable two-factor authentication on your accounts. Report the domain to your security team and consider blocking it at the network level. PhishDestroy recommends adding this domain to your blocklist and monitoring for any related activity.