coim-base-extantion[.]pages[.]dev

The domain coim-base-extantion.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge IP 188.114.97.3, located in the United States under ASN 13335 (Cloudflare, Inc.). The site is protected by a Google Trust Services / WE1 SSL certificate and serves content over HTTP/3 with HSTS enabled. DNS is hosted on grace.ns.cloudflare.com and quentin.ns.cloudflare.com. When accessed, the server returned HTTP 403, and the page title presented by the service was "Suspected phishing site | Cloudflare," indicating that the content has been taken offline or flagged by Cloudflare’s abuse mechanisms.

VirusTotal scans show nine of ninety‑five security vendors flagging the domain, and Google Safe Browsing classifies it as a social‑engineering threat. The site is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. Independent scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The observed scam type is Brand Impersonation, although the specific brand being spoofed is not disclosed in the available artifacts.

Current intelligence does not reveal any additional infrastructure such as command‑and‑control servers, payloads, or credential‑harvesting forms. Defenders should continue to block the domain at network perimeter devices, update DNS blocklists with the observed nameservers and IP address, and monitor for any re‑registration attempts. Given the low trust score, multiple vendor detections, and the presence on Google Safe Browsing, the domain should be treated as high‑risk and incorporated into security telemetry to prevent user exposure.