claimsdapps[.]pages[.]dev

This domain, claimsdapps.pages.dev, poses a significant threat as a phishing site designed to impersonate Coinbase, a major cryptocurrency exchange platform. Users visiting this site may be tricked into entering sensitive credentials, such as login details or private keys, under the false pretense of resolving EVM-related issues or accessing wallet services. The site mimics legitimate Coinbase interfaces, increasing the likelihood of successful deception, particularly among users unfamiliar with phishing tactics targeting cryptocurrency infrastructure.

Analysis indicates this domain is actively malicious, with 15 out of 95 security vendors on VirusTotal flagging it as phishing or fraudulent. The domain was registered on January 30, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.45.42, hosted on Cloudflare’s network (AS13335). It appears on six security blocklists, including those maintained by browser extensions and cryptocurrency security platforms. The page title, 'EVM Resolve,' suggests a focus on Ethereum Virtual Machine-related scams, a common tactic to exploit users seeking technical support or token recovery.

If a user has visited claimsdapps.pages.dev or interacted with its content, immediate action is required to mitigate risk. First, any credentials or private keys entered on the site should be considered compromised and revoked. Users should disconnect any connected wallets from the site and review recent transactions for unauthorized activity. It is also recommended to scan the device for malware, as phishing sites may distribute additional payloads. Finally, affected users should report the incident to the impersonated platform’s security team and monitor accounts for suspicious activity.