recompile01[.]pages[.]dev

Analysis of recompile01.pages.dev indicates that the domain was registered on 21 February 2026 through Cloudflare, Inc. The authoritative nameservers maleah.ns.cloudflare.com and everton.ns.cloudflare.com resolve the domain to the IPv6 address 2606:4700:310c::ac42:2f65, which belongs to AS13335 operated by Cloudflare, Inc. The hosting location is identified as the United States. The site presented the page title “CexRpc Decentralized DApp” and employed a TLS certificate issued by Google Trust Services under the WE1 intermediate, confirming the use of a valid HTTPS configuration with HSTS and HTTP/3 enabled. Despite the legitimate certificate chain, the content was classified as a wallet/seed phishing attempt targeting Coinbase users, as indicated by the brand impersonation label and the specific scam type. Defensive feeds have listed the domain on two blocklists, and it is actively blocked by PhishDestroy and ScamSniffer.

Google Safe Browsing has flagged the domain for social engineering, and VirusTotal reports three of ninety‑three scanners flagging the host as malicious. The Gridinsoft trust score of 0 / 100 further reflects a high confidence in malicious intent. An HTTP 403 response was observed at the time of analysis, and the current status is recorded as taken offline, which suggests the infrastructure may have been dismantled or temporarily disabled.

However, the observed infrastructure—Cloudflare‑hosted IPv6 address, brand‑specific impersonation, and the use of a legitimate TLS certificate—mirrors tactics commonly employed in credential‑harvesting campaigns. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for re‑registration or similar naming patterns, and consider adding the associated IP address and nameserver pairs to deny lists. Ongoing threat‑intel correlation with other Coinbase‑related phishing artifacts is advised to detect potential campaign evolution.