cloud-coinbs-ixtnsion[.]pages[.]dev

The domain cloud-coinbs-ixtnsion.pages.dev was created on February 21, 2026 and is registered through Cloudflare, Inc. Its authoritative nameservers are aspen.ns.cloudflare.com and todd.ns.cloudflare.com, and the domain resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. An HTTPS connection is presented using a Google Trust Services / WE1 certificate, and the site enforces HSTS while supporting HTTP/3, indicating the use of modern Cloudflare delivery features. The page title returned by the server is "Suspected phishing site | Cloudflare" and the HTTP response code is 403, suggesting that access to the content is currently restricted. VirusTotal reports that 13 of 95 security vendors have flagged the domain, and Google Safe Browsing classifies it as a social engineering threat.

The domain appears on a single security blocklist and has been blocked by PhishDestroy. Independent trust scoring from Gridinsoft assigns a score of 0 out of 100, and the documented scam type is credential phishing. The current operational status is offline, and the domain has been taken down.

While the available data confirms that the infrastructure is controlled by Cloudflare and that multiple security products identify the domain as malicious, the exact phishing payload or target audience remains undocumented. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the observed IP and domain, and monitor for any re‑registration attempts. Threat intelligence teams should correlate any future sightings with the known nameservers, IP address, and SSL fingerprint to prevent re‑use of the same hosting assets.