faqs-page-base-coin[.]pages[.]dev

This domain, faqs-page-base-coin.pages.dev, was registered on February 21, 2026 through Cloudflare, Inc. and is currently offline, returning an HTTP 403 status code. The authoritative nameservers bruce.ns.cloudflare.com and gloria.ns.cloudflare.com show that the domain is hosted on Cloudflare’s DNS platform. DNS resolution points to IP 172.66.47.51, which belongs to AS13335 Cloudflare, Inc. in the United States. TLS termination is handled by a Google Trust Services WE1 certificate, and the site enforces HSTS and HTTP/3, confirming the use of modern Cloudflare edge services.

Security telemetry indicates the domain appears on a single public blocklist and has been flagged by PhishDestroy as a brand‑impersonation campaign. Google Safe Browsing labels it as social engineering, and VirusTotal records 11 of 93 scanned scanners marking the domain as malicious, reinforcing the high‑risk assessment. The Gridinsoft trust score of 0/100 further demonstrates a lack of reputation. The response page title "Suspected phishing site | Cloudflare" is displayed, suggesting that Cloudflare’s protective interstitial page is being served after the site was taken offline.

Infrastructure analysis reveals that the threat actor leveraged reputable hosting (Cloudflare) and a valid Google‑issued TLS certificate to blend in with legitimate traffic and evade basic reputation checks. The presence of HSTS and HTTP/3 indicates that the site was intentionally configured for normal‑looking HTTPS delivery, a technique commonly employed by phishing operators to increase success rates.

Uncertainty remains regarding the specific brand being spoofed because no brand identifier appears in the collected metadata. No content was retrieved for the site, so the exact phishing payload or credential‑stealing mechanism cannot be confirmed. Defenders should block the domain at DNS and network perimeter, add the associated IP address to relevant threat‑intel feeds, and monitor for any re‑registration attempts.