coinoswallet[.]pages[.]dev

Analysis of coinoswallet.pages.dev conducted on 24 July 2026 shows that the domain was created on 21 February 2026 and is hosted behind Cloudflare’s network (AS13335). The hostname resolves to the IPv4 address 188.114.97.3, which is geolocated to the United States and belongs to Cloudflare, Inc. No TLS certificate is presented, indicating that the site operates without HTTPS encryption. The HTTP response currently returns a page titled “Suspected phishing site | Cloudflare”, and the domain status is reported as taken offline. Registry data list Cloudflare, Inc. as the registrar, consistent with the observed hosting provider.

The site has been added to four independent blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, all of which categorize it as a crypto‑drainer campaign. VirusTotal records indicate that the URL was scanned by 93 AV engines, none of which raised a detection at the time of analysis; the absence of a flag does not constitute assurance of safety. The overall risk posture remains “under investigation” because the domain is actively referenced in threat‑intel feeds as a crypto‑related scam, yet the offline status limits immediate exposure. Defenders should continue to enforce deny‑list rules for the domain and the associated IP address, especially within corporate firewalls and DNS filtering solutions.

Given the lack of a valid SSL certificate, any attempt to establish a secure connection will fail, providing an additional indicator for automated blocklists. Continuous monitoring of Cloudflare‑issued subdomains is recommended, as adversaries frequently rotate prefixes within the same provider. Incident responders are advised to capture any residual network artifacts, correlate them with the 188.114.97.3 address, and apply IOC enrichment using the blocklist identifiers noted above. The evidence assembled here, anchored by seed 3b2ddc, supports proactive containment pending further forensic investigation.