presyncho[.]pages[.]dev

This domain, presyncho.pages.dev, is identified as a high-risk brand impersonation phishing site currently offline. The threat specifically targets Coinbase users, mimicking legitimate infrastructure to deceive victims into disclosing sensitive credentials or executing unauthorized transactions. The page title "EVM Resolve" suggests an attempt to exploit Ethereum Virtual Machine-related services, a common tactic in cryptocurrency-focused phishing campaigns. Analysis indicates the domain was registered on March 14, 2026, through Cloudflare, Inc., and is flagged by 13 of 95 security vendors on VirusTotal. It resolves to the IP address 172.66.47.157, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain appears on three security blocklists, including PhishDestroy and MetaMask, and is explicitly labeled as phishing by Google Safe Browsing. The SSL certificate is issued by Google Trust Services (WE1), a detail often leveraged to lend false legitimacy to malicious sites. As of the latest assessment, presyncho.pages.dev has been taken offline, though residual risks may persist if cached or archived versions remain accessible. Organizations and users are advised to block the domain and its associated IP (172.66.47.157) at the network level. Security teams should monitor for related indicators, including the SSL certificate thumbprint and page title "EVM Resolve," in logs or endpoint telemetry. Users who interacted with the domain should revoke active sessions, rotate credentials, and verify transaction histories for unauthorized activity.