help-coiinpro-login[.]pages[.]dev

The domain help-coiinpro-login.pages.dev was created on February 21 2026 and is hosted on Cloudflare's network (AS13335) with the IPv4 address 172.66.44.93 located in the United States. DNS resolution uses the Cloudflare nameservers newt.ns.cloudflare.com and savanna.ns.cloudflare.com, and the registration was performed through Cloudflare, Inc. When accessed, the site returned HTTP status code 403 and presented the page title "Suspected phishing site | Cloudflare," indicating that the content is being served through Cloudflare's edge platform. Google Safe Browsing flags the URL for social engineering, and 14 of 93 VirusTotal scanners have identified the domain as malicious, reinforcing the phishing classification.

The TLS handshake presents a certificate issued by Google Trust Services under the WE1 label, and the connection enforces HSTS while supporting HTTP/3, confirming a modern Cloudflare configuration. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single external blocklist; it is currently blocked by the PhishDestroy service. The observed scam type is credential phishing, consistent with the page title and the broader threat profile.

The domain is presently offline, confirming that takedown actions have been applied. Defenders should add the domain name and its resolving IP address to local deny lists, monitor for any future reuse of the same nameserver set or IP range, and block inbound traffic to 172.66.44.93 at the network perimeter. Correlation with other credential‑theft campaigns targeting similar login flows is recommended, and continuous re‑evaluation of the IP block is advised as Cloudflare frequently hosts multiple unrelated domains on shared infrastructure.