coin-bess-pro[.]pages[.]dev

This domain, coin-bess-pro.pages.dev, is identified as a credential theft phishing site targeting users of cryptocurrency platforms. Analysis indicates the site employs deceptive login interfaces designed to harvest user credentials, likely for unauthorized account access or financial theft. No explicit drainer kit signatures were observed, but the infrastructure aligns with known credential harvesting campaigns impersonating blockchain services. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on October 09, 2025, and resolves to the IP address 188.114.97.3, associated with AS13335 (Cloudflare, Inc.) in the United States. Detection metrics show 15 out of 95 security vendors flagged the domain on VirusTotal, while Google Safe Browsing explicitly categorizes it as a phishing threat. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). The page title, 'Suspected phishing site | Cloudflare,' further corroborates its malicious classification. As of the latest assessment, the domain has been taken offline, likely due to enforcement actions by the hosting provider or security entities. However, residual risk persists due to the transient nature of such campaigns, where threat actors frequently rotate domains or IPs. Users who interacted with the site are advised to revoke any exposed credentials, enable multi-factor authentication, and monitor associated accounts for unauthorized activity. Organizations should update blocklists to include this domain and its resolved IP to mitigate future exposure.