mogcoinclaimbonus[.]pages[.]dev

The domain mogcoinclaimbonus.pages.dev was created on March 05, 2026 and is currently offline. Infrastructure analysis shows the domain is hosted on Cloudflare’s network (ASN 13335, United States) and resolves to IP address 172.66.44.76. The site is served over HTTPS with a certificate issued by Google Trust Services under the WE1 certificate profile, and HSTS and HTTP/3 are enabled, indicating a modern TLS configuration. Nameservers colin.ns.cloudflare.com and lilith.ns.cloudflare.com further confirm Cloudflare registration.

The page title returned by the server is "EVM Resolve," and the HTTP response code is 403, suggesting restricted access to the underlying content. Reputation services assign a very low trust rating: Scamadviser scores the domain 10/100 and Gridinsoft reports a score of 0/100. The domain appears on three public security blocklists and has been flagged by three dedicated anti‑phishing platforms—PhishDestroy, MetaMask, and SEAL. VirusTotal analysis records five detections out of 94 scanned security vendors, reinforcing the suspicion of malicious intent.

The documented scam type is a "Fake Airdrop" that impersonates Coinbase, targeting cryptocurrency users with a claim of free tokens. While the exact page content has not been captured, the combination of low trust scores, blocklist listings, vendor detections, and the explicit fake‑airdrop label provides strong evidence of a credential‑harvesting operation. Defenders should add mogcoinclaimbonus.pages.dev to internal blocklists, monitor for DNS queries to the associated IP address, and advise users that any unsolicited Coinbase‑related airdrop offers originating from this domain are fraudulent. Continuous monitoring of Cloudflare‑registered domains that reference "EVM" or similar cryptocurrency terminology is recommended to detect similar campaigns promptly.