bridgewalle[.]pages[.]dev

This domain, bridgewalle.pages.dev, is actively engaged in brand impersonation targeting Coinbase users with a crypto drainer scheme. The page, titled 'EVM Resolve,' mimics legitimate wallet resolution interfaces to deceive victims into connecting their cryptocurrency wallets. Once connected, the malicious infrastructure is designed to execute unauthorized transactions, draining assets from compromised wallets. The threat specifically exploits trust in Coinbase's branding to facilitate credential theft and financial loss, with a focus on Ethereum Virtual Machine (EVM) compatible wallets. Analysis indicates the domain was registered on April 22, 2025, through Cloudflare, Inc., and currently resolves to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common practice among threat actors to lend an appearance of legitimacy. Detection metrics reveal limited but targeted flagging, with 2 out of 95 security vendors on VirusTotal identifying the domain as malicious. Additionally, the domain appears on one security blocklist, suggesting early-stage detection in the threat lifecycle. Users who have interacted with bridgewalle.pages.dev are advised to take immediate action to mitigate potential compromise. First, revoke any wallet connections or authorizations granted to the domain via wallet management interfaces. Next, transfer remaining assets to a new, secure wallet address and monitor all connected accounts for unauthorized transactions. It is critical to avoid reusing credentials or wallet addresses associated with the compromised interaction. If financial loss has occurred, report the incident to relevant financial authorities and provide all technical indicators, including the domain, IP address, and transaction hashes, to aid in further investigation.