welcome-net-coiin-auth[.]pages[.]dev

Analysis of welcome-net-coiin-auth.pages.dev indicates a credential phishing domain hosted on Cloudflare Pages infrastructure. The domain, created on February 21, 2026, was flagged by 14 of 93 security vendors on VirusTotal, though this detection count reflects only a subset of available engines. Gridinsoft and Scamadviser assigned trust scores of 0/100 and 1/100, respectively, classifying the site as credential phishing. The domain is currently offline, returning an HTTP 403 status with the page title 'Suspected phishing site | Cloudflare,' suggesting Cloudflare’s automated mitigation may have intervened.

Infrastructure analysis reveals the domain resolves to 188.114.97.3, an IP address assigned to AS13335 (Cloudflare, Inc.) in the United States. The domain uses Cloudflare nameservers (brian.ns.cloudflare.com, jocelyn.ns.cloudflare.com) and a Google Trust Services SSL certificate (WE1). Detected technologies include HSTS, Cloudflare CDN, and HTTP/3, consistent with modern phishing campaigns leveraging legitimate hosting providers to evade detection. The domain appears on one security blocklist, as recorded by PhishDestroy.

While the exact content and targeted brand remain unconfirmed, the available evidence—including the scam type classification and page title—supports its use for credential harvesting. Defenders should treat this domain as malicious and prioritize blocking it at the DNS and network levels. Further investigation into associated infrastructure (e.g., redirect chains, linked domains) is recommended to identify related threats. Given the domain’s offline status, historical artifacts or cached content may provide additional context for attribution or victim identification.