dtfhjfyhfyfuyfvuj[.]pages[.]dev

The domain dtfhjfyhfyfuyfvuj.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 188.114.97.3 located in the United States under ASN 13335. The site employed a Cloudflare‑issued TLS certificate identified as SSL Corporation / Cloudflare TLS Issuing ECC CA 3 and advertised HSTS and HTTP/3, indicating modern web security features. An HTTP request returns a 403 status, and the page title reported by scanning tools is “EVM Resolve”. The domain is linked to a fake‑airdrop campaign that impersonates Coinbase, as indicated by the brand target field.

Google Safe Browsing flags the URL as social engineering, and the domain appears on one external blocklist (PhishDestroy). VirusTotal analysis recorded two detections out of ninety‑three scanning engines, and the Gridinsoft trust score is 0 / 100, reflecting a high confidence of malicious intent. Nameserver records point to owen.ns.cloudflare.com and raegan.ns.cloudflare.com, confirming the Cloudflare hosting environment.

The site is currently offline, which may be the result of takedown actions or a temporary suspension. Defenders should block the domain and its resolving IP at perimeter devices, monitor for any related command‑and‑control activity or payload distribution using the same IP range, and update URL filtering to include the observed hostnames and the “EVM Resolve” page‑title pattern. Continuous threat‑intel monitoring is advised to detect any re‑use of the fake‑airdrop kit targeting Coinbase users.