rectifysvalida[.]pages[.]dev

On July 24, 2026, the domain rectifysvalida.pages.dev was observed hosting a fraudulent offering identified as a “Fake Airdrop” targeting Coinbase users. The site presented the page title “EVM Resolve”, which aligns with the cryptocurrency‑focused theme of the campaign. The domain was registered on March 03, 2026 through Cloudflare, Inc., and uses Cloudflare’s DNS infrastructure (carol.ns.cloudflare.com, dimetris.ns.cloudflare.com). DNS resolution returns the address 172.66.46.247, an IP owned by AS13335 Cloudflare, Inc., and geolocated to the United States. The TLS certificate is issued by Google Trust Services under the WE1 identifier, and the server advertises HSTS and HTTP/3, indicating a modern Cloudflare edge configuration.

Multiple defensive services have flagged the domain. PhishDestroy, MetaMask, and SEAL have added it to their blocklists, and the domain appears on three additional security blocklists. VirusTotal analysis shows that five of ninety‑four scanners returned a malicious verdict, reinforcing the suspicion of abuse. The HTTP response code returned by the origin is 403, suggesting that the site is no longer serving content. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence of malicious intent.

The current operational status is recorded as offline. The evidence confirms that rectifysvalida.pages.dev was actively used to impersonate Coinbase in a fake‑airdrop scheme and that it leveraged reputable cloud services to obscure its true location. At present, the site is taken offline, but the infrastructure components—particularly the Cloudflare‑hosted IP and the Google‑issued TLS certificate—remain reusable for future campaigns. Defenders should continue to block the domain and associated IP address at network perimeters, monitor the listed nameservers for newly‑issued subdomains, and update threat‑intel feeds with the observed indicators.