service-en-coinpro-web[.]pages[.]dev

Analysis of service-en-coinpro-web.pages.dev indicates that the site is currently taken offline, returning HTTP 403 for all requests. The page title reported by passive DNS is identical to the domain name, suggesting minimal effort to disguise the URL. The domain was registered on February 21 2026 through Cloudflare, Inc., and resolves to the Cloudflare edge address 172.66.47.131, which is geolocated to Canada (Cloudflare, Inc.). Nameserver delegation uses sandra.ns.cloudflare.com and ishaan.ns.cloudflare.com, confirming the Cloudflare hosting environment. TLS configuration includes HTTP 3 and HSTS enforcement, consistent with standard Cloudflare services.

Threat intelligence flags the domain as a credential‑phishing operation. VirusTotal records show that 10 of 93 security vendors label the domain as malicious, and it appears on one external blocklist. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. PhishDestroy has already added the domain to its blocklist. No additional public reports or malware kit identifiers are available, and the content of the site has not been captured, leaving the exact phishing lures unknown.

Defenders should immediately block 172.66.47.131 and the full FQDN at network perimeter and DNS filtering solutions. Continuous monitoring of Cloudflare‑hosted IP ranges for new domains created after February 2026 is advised, as the registrar can be leveraged to spin up short‑lived phishing sites. Given the low trust score and vendor detections, inclusion of the domain in internal blocklists and threat‑intel feeds is recommended. Analysts should also watch for any re‑activation of the domain, which would likely return a 403 or redirect response before serving malicious content.