extnsion-coinnbse-logn[.]pages[.]dev

Analysis of extnsion-coinnbse-logn.pages.dev indicates a high‑risk credential‑phishing operation that has been taken offline as of the report date, July 24 2026. The domain was registered on February 21 2026 through Cloudflare, Inc., and resolves to the Cloudflare edge address 172.66.44.94, located in the United States under ASN 13335. The site presented the page title "Suspected phishing site | Cloudflare" and returned an HTTP 403 status, suggesting that access was deliberately blocked, possibly by Cloudflare’s protective rules. Infrastructure fingerprints show the presence of HTTP/3, HSTS enforcement, and the Cloudflare network, confirming that the attacker leveraged Cloudflare’s CDN and security services to obscure origin infrastructure.

The SSL certificate is issued by Google Trust Services under the WE1 root, a legitimate certificate chain that does not inherently indicate malicious intent but is commonly abused to lend credibility to phishing sites. Google Safe Browsing has flagged the domain for social‑engineering threats, and VirusTotal records show 13 of 93 participating security vendors labeling the domain as malicious, reinforcing the suspicion of phishing activity. Independent reputation services assign extremely low trust scores: Gridinsoft rates the domain 0/100, and Scamadviser assigns 1/100, both reflecting consensus that the site is untrustworthy. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy, confirming that at least one anti‑phishing consortium has taken remediation action.

The known scam type is credential phishing, yet the specific target brand or service is not disclosed in the available data, and the exact content of the page beyond the title has not been publicly captured. Defenders should continue to block the domain at network perimeters, update intrusion‑detection signatures with the observed IP and certificate details, and monitor for any re‑use of the same Cloudflare nameservers (quentin.