sso-coin-en-io[.]pages[.]dev

Analysis of sso-coin-en-io.pages.dev shows the domain was registered through Cloudflare on 21 February 2026 and is hosted on Cloudflare’s network (ASN 13335, United States). The site resolves to 172.66.44.130 and serves a TLS certificate issued by Google Trust Services under the WE1 designation, indicating a valid HTTPS endpoint. HTTP requests return a 403 status, and the public page title displayed by Cloudflare is “Suspected phishing site | Cloudflare”, which is the default block page presented when Cloudflare has taken the site offline for abuse. The domain employs HSTS, HTTP/3, and uses Cloudflare’s DNS nameservers alina.ns.cloudflare.com and jack.ns.cloudflare.com.

Security scoring from Gridinsoft assigns a trust score of 0 / 100, and 13 of 93 VirusTotal scanners flagged the domain as malicious. It appears on one external blocklist and is listed as blocked by PhishDestroy. The recorded scam type is credential phishing, indicating attempts to harvest login credentials.

Because the site is currently offline, active content cannot be inspected, leaving the exact phishing payload and target brand unknown. Defenders should continue to block the domain at network perimeter and proxy layers, monitor for any resurrection attempts, and correlate any observed credential‑theft incidents with the domain’s creation date and hosting provider. Additional scrutiny of traffic to Cloudflare‑hosted subdomains with similar naming patterns is advised, as the infrastructure suggests the operator relies on Cloudflare’s rapid provisioning to spin up disposable phishing sites.