coinebash-pro-login[.]pages[.]dev

coinebash-pro-login.pages.dev is a tenant hostname on Cloudflare, not a separately registered domain. PhishDestroy first observed the hostname on Nov 19, 2025. The hostname uses “login,” a pattern consistent with a account-login lure; no target brand is confirmed from stored content. The captured page title is “Worker threw exception | coinebash-pro-login.pages.dev | Cloudflare”. Stored page analysis classifies the content as credential phishing. Current evidence score: 77/100 (critical).

One source contains a positive finding: VirusTotal. VirusTotal recorded 9 detections among 95 engines: ChainPatrol, alphaMountain.ai, BitDefender, CyRadar, G-Data, Kaspersky, Lionic, Sophos, Webroot on Jul 10, 2026 at 14:59 UTC. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 06:20 UTC. URLQuery recorded no positive detection; no observation timestamp was retained. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 02:57 UTC.

HTTP 500 server error was recorded on Aug 7, 2026 at 22:00 UTC. Cloudflare is the hosting platform for this tenant, not its registrar. At collection time, the hostname resolved to 2606:4700:310c::ac42:2f5d on AS13335 (CLOUDFLARENET, US). The IP and ASN identify shared Cloudflare infrastructure, not the tenant operator. DOM analysis on Jul 9, 2026 at 06:21 UTC returned 0/100; the source detections above were recorded separately. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. The platform TLS certificate was issued by Google Trust Services / WE1 with validity through Apr 14, 2026; checked Mar 11, 2026 at 12:49 UTC.

Stored content provides classification context, but only one source contains a positive finding.