app-coin-bess-pro-io[.]pages[.]dev

Analysis of the domain app-coin-bess-pro-io.pages.dev indicates that it was registered on February 21, 2026 through Cloudflare, Inc. and is currently resolved to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents a HTTP 403 response and the page title returned by the server is "Suspected phishing site | Cloudflare," consistent with the classification of a credential phishing campaign. The hosting environment advertises HSTS, Cloudflare protection, and HTTP/3 support, and the TLS certificate is issued by Google Trust Services under the WE1 label, confirming the use of a valid SSL chain. Nameserver records point to maleah.ns.cloudflare.com and lynn.ns.cloudflare.com, confirming the domain is fully managed within Cloudflare's DNS infrastructure.

Reputation signals show the domain appears on a single security blocklist and has been blocked by PhishDestroy. Google Safe Browsing has flagged the URL for social engineering, and VirusTotal scans report that 14 of 93 security vendors have identified malicious activity associated with the domain. The Gridinsoft trust score of 0 out of 100 reinforces the high‑risk assessment. No evidence of additional infrastructure, such as backend command‑and‑control servers, has been observed, and the site is reported as taken offline at the time of this assessment.

Defenders should continue to block traffic to 188.114.96.3 and to the fully qualified domain name, enforce URL filtering based on the observed indicators, and monitor for any re‑registration attempts that reuse the same sub‑domain pattern. Given the confirmed credential‑phishing classification, organizations should educate users about the risk of social‑engineering prompts and ensure that multi‑factor authentication is enforced for critical accounts. Ongoing vigilance is advised, as the underlying Cloudflare infrastructure can be repurposed for new malicious domains.