revertfinance[.]pages[.]dev

The domain revertfinance.pages.dev was registered on February 21, 2026 and is serviced through Cloudflare, Inc. Its authoritative nameservers are lilith.ns.cloudflare.com and colin.ns.cloudflare.com. DNS resolution points to 172.66.47.74, an address owned by AS13335 Cloudflare in the United States. The site presents an SSL certificate issued by Google Trust Services under the WE1 label, confirming TLS termination at the Cloudflare edge. HTTP requests return a 403 status code and the current operational state is reported as offline.

Google Safe Browsing has flagged the domain for social engineering, and VirusTotal records 8 of 93 security vendors marking it as malicious. The domain appears on a single external blocklist and received a Gridinsoft trust score of 0 out of 100. Automated analysis identifies the threat as a “Fake Airdrop” that impersonates Coinbase, consistent with the page title “EVM Resolve”. Observed technologies include HSTS, Cloudflare services, and HTTP/3.

While the content of the landing page has not been publicly captured, the combination of registrar information, IP ownership, TLS certificate, and multiple vendor detections provides strong evidence of a credential‑harvesting infrastructure targeting Coinbase users. Defenders should add revertfinance.pages.dev to URL filtering and email security policies, monitor the IP range for re‑use, and enforce multi‑factor authentication for affected accounts. Continuous threat‑intel feeds should be consulted for any re‑appearance of the domain or related subdomains.