get-coinbes-en-extensen[.]pages[.]dev

The domain get-coinbes-en-extensen.pages.dev has been identified as a crypto credential theft operation, designed to harvest wallet login credentials and private keys from unsuspecting users. Analysis indicates the site is no longer active, having been taken offline following detection. No specific brand impersonation was confirmed, but the infrastructure aligns with common cryptocurrency drainer tactics observed in recent campaigns. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. and resolved to the IP address 172.66.47.125, located within the United States under AS13335 (Cloudflare, Inc.). The domain was created on October 14, 2025, and has since been flagged by 12 of 95 security vendors on VirusTotal. Additionally, the domain appears on one security blocklist and was proactively blocked by multiple threat intelligence feeds. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the malicious intent of the site, as phishing operations frequently leverage valid certificates to appear legitimate. Current status confirms the domain is offline, though residual risk remains for users who may have interacted with the site prior to takedown. Organizations and individuals are advised to monitor for unauthorized transactions if wallet credentials were entered. Network administrators should update blocklists to include the domain and associated IP address. End-users should verify the authenticity of cryptocurrency-related sites by cross-referencing official sources and enabling multi-factor authentication on all financial accounts. Proactive threat hunting for related infrastructure is recommended, as actors may pivot to new domains using similar naming conventions.