extn-base-com-coin[.]pages[.]dev

This domain, extn-base-com-coin.pages.dev, was registered on March 11 2026 via Cloudflare Pages and resolves to the Cloudflare edge address 172.66.45.32, which is announced by AS13335 Cloudflare, Inc. in the United States. The site presents the page title “Suspected phishing site | Cloudflare”, a generic warning page served by Cloudflare that does not reveal the underlying content. The SSL certificate is issued by Google Trust Services under the WE1 authority, indicating a valid TLS chain but offering no assurance of benign intent. An HTTP 403 response is returned, suggesting the origin server is currently refusing access; the domain’s status is listed as offline at the time of analysis.

VirusTotal records show that two out of ninety‑four scanning engines have flagged the domain, and three independent blocklists (PhishDestroy, MetaMask, SEAL) have already listed it as malicious. The Gridinsoft trust score of 0 / 100 reinforces the assessment of high risk. The listed nameservers, kiki.ns.cloudflare.com and algin.ns.cloudflare.com, are standard Cloudflare resolver entries and do not provide additional attribution. The only explicitly identified threat category is “Brand Impersonation”, but the specific brand being spoofed is not disclosed in the available data.

Consequently, the confidence in the domain’s malicious purpose stems from its rapid creation, low trust score, multiple vendor detections, and inclusion on reputable blocklists. Uncertainties remain regarding the exact payload, victim targeting, and any command‑and‑control infrastructure that may be associated once the site is re‑enabled. Defenders should block the hostname at DNS and proxy layers, add the IP address 172.66.45.32 to network‑level deny lists, monitor for re‑registration or changes in TLS certificate, and continue to observe related Cloudflare Pages subdomains for similar patterns. Ongoing threat‑intel feeds should be consulted for any future observations tied to this domain or its hosting AS.