evmdecentralisedportal[.]pages[.]dev

Analysis indicates evmdecentralisedportal.pages.dev is a credential harvesting portal designed to impersonate Coinbase services under a deceptive EVM-themed interface labeled 'EVM Resolve'. The page is engineered to solicit wallet authentication and recovery phrase input, enabling unauthorized access to user digital asset accounts. The infrastructure suggests fast-flux deployment on Cloudflare Anycast, consistent with short-lived phishing operations targeting cryptocurrency users.

Technical indicators confirm multiple independent detections and attribution signals. VirusTotal reports 1/95 security vendors flagging the domain, while it is concurrently listed on 3 separate security blocklists, including PhishDestroy, MetaMask, and SEAL. The domain resolves to IP 188.114.97.3 hosted under AS13335 (Cloudflare, Inc.), with SSL issued via Let's Encrypt E8. Registration was performed through Cloudflare, Inc., and domain creation date is March 12, 2026. These factors indicate recently deployed infrastructure with partial but active detection coverage.

Users who interacted with the site should assume potential credential compromise, particularly if wallet seed phrases or authentication signatures were provided. Immediate actions include revoking token approvals, migrating assets to a newly generated wallet with uncompromised keys, and reviewing connected session logs across all related services. Network indicators associated with the domain should be blocked at DNS and endpoint levels. Continued monitoring is advised due to active status and ongoing accessibility despite blocklist inclusion.