coinhelplive[.]pages[.]dev

coinhelplive.pages.dev is a tenant hostname on Cloudflare, not a separately registered domain. PhishDestroy first observed the hostname on Mar 6, 2026. Stored content metadata identifies Genericcloudflare as the apparent target. The captured page title is “Suspected phishing site | Cloudflare”. Current evidence score: 80/100 (critical).

Positive findings are stored from 5 sources: VirusTotal, MetaMask, SEAL, Google Safe Browsing, and URLScan. VirusTotal recorded 9 detections among 94 engines: ADMINUSLabs, BitDefender, CyRadar, ESET, Fortinet, G-Data, Google Safebrowsing, Lionic, Sophos on Jul 18, 2026 at 20:45 UTC. MetaMask and SEAL listed the hostname in the separate external-blocklist snapshot on Aug 8, 2026 at 02:20 UTC. Google Safe Browsing flagged the domain: Social Engineering on Mar 6, 2026 at 12:10 UTC. URLScan returned a malicious verdict with score 100; scan metadata assigned phishing as its category on Jul 29, 2026 at 03:14 UTC. Non-positive and contextual checks: URLQuery recorded no positive detection on Mar 6, 2026 at 11:15 UTC. PhishStats returned no feed match on Mar 6, 2026 at 12:10 UTC.

An access-restricted HTTP 403 response was recorded on Aug 7, 2026 at 01:01 UTC. Cloudflare is the hosting platform for this tenant, not its registrar. At collection time, the hostname resolved to 188.114.97.3 on AS13335 (CLOUDFLARENET - Cloudflare, Inc., US). The IP and ASN identify shared Cloudflare infrastructure, not the tenant operator. DOM analysis on Mar 25, 2026 at 21:20 UTC returned 0/100; the source detections above were recorded separately. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and URLQuery. The platform TLS certificate was issued by Google Trust Services / WE1 with validity through Jun 3, 2026; checked Mar 15, 2026 at 05:52 UTC.

The content indicators and 5 positive source findings support the current Genericcloudflare impersonation and phishing classification. The target field identifies Genericcloudflare, but the record does not establish whether the page requested credentials, a seed phrase, or a wallet connection.