renzolast[.]pages[.]dev

Analysis of the domain renzolast.pages.dev indicates it was actively involved in a wallet and seed-phishing campaign targeting Coinbase users. The domain was registered on February 21, 2026, through Cloudflare, Inc., and resolved to the IP address 172.66.47.203, hosted on Cloudflare's network (AS13335) in the United States. The page title was identified as 'Renzo,' though the exact content and functionality of the site remain unconfirmed as the domain is currently offline and returning an HTTP 403 status. Infrastructure analysis reveals the use of Cloudflare nameservers (tricia.ns.cloudflare.com and terry.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), suggesting an attempt to appear legitimate.

However, the domain holds a Scamadviser trust score of 1/100 and a Gridinsoft trust score of 0/100, with three security blocklists flagging it for malicious activity. Detection engines on VirusTotal identified the domain as malicious, with 12 of 93 security vendors marking it as a threat. Additional confirmation comes from PhishDestroy, ScamSniffer, and Enkrypt, which have all classified the domain as part of a phishing operation. The domain's classification as a wallet or seed-phishing scam aligns with the targeting of Coinbase, a known cryptocurrency exchange.

Defenders should treat this domain as high-risk and prioritize blocking or monitoring any connections to it. Given its current offline status, further investigation into associated infrastructure, such as linked IP addresses or related domains, is recommended to identify potential residual threats. No evidence suggests the domain is safe for user interaction.