cellframeacredition[.]pages[.]dev

This domain, cellframeacredition.pages.dev, poses a high-risk brand impersonation threat specifically targeting users of the Coinbase cryptocurrency platform. Analysis indicates the site mimics legitimate Coinbase interfaces, likely to deceive victims into interacting with fraudulent Ethereum Virtual Machine (EVM) smart contracts or disclosing wallet credentials. The page title 'EVM Resolve' suggests an attempt to exploit users seeking blockchain resolution services, a common tactic in crypto drainer schemes where funds are siphoned from connected wallets without authorization. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain is flagged by 10 out of 95 security vendors on VirusTotal, with detection names including 'Phishing' and 'Fraudulent Website.' Registered through Cloudflare, Inc. on March 14, 2026, the domain resolves to the IP address 188.114.97.3 and appears on three distinct security blocklists, including MetaMask and PhishDestroy. Additional technical details include the use of HSTS, HTTP/3, and a Google Trust Services SSL certificate, which may lend a false sense of legitimacy to unsuspecting users. The Gridinsoft trust score of 0/100 further corroborates the malicious classification. Users who visited cellframeacredition.pages.dev should take immediate remediation steps to mitigate potential compromise. Disconnect any wallets or accounts linked to the site and revoke all active smart contract approvals using a trusted blockchain explorer. Monitor connected accounts for unauthorized transactions and rotate credentials for any platforms accessed during the interaction. If cryptocurrency was transferred, report the incident to relevant blockchain analysis services and local cybercrime authorities. The domain’s current offline status does not eliminate risk, as threat actors may reactivate similar infrastructure under different names.