learn-coin-web-extension[.]pages[.]dev

Analysis of learn-coin-web-extension.pages.dev, observed on July 23, 2026, indicates a high‑risk credential phishing operation that has been taken offline. The domain was registered on February 21, 2026 through Cloudflare, Inc., and its authoritative nameservers are kayden.ns.cloudflare.com and margot.ns.cloudflare.com. DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site served an HTTP 403 response and presented the page title "Suspected phishing site | Cloudflare", confirming that Cloudflare’s protective page was triggered. SSL termination is performed by Google Trust Services under the WE1 certificate, showing a valid TLS chain but offering no indication of benign intent. The infrastructure employs HSTS and HTTP/3, both typical of modern Cloudflare‑hosted services.

Reputation checks show the domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy. Google Safe Browsing classifies the URL as a social engineering threat, and Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. VirusTotal scans recorded 13 detections out of 93 submitted security vendors, reflecting a consensus among multiple scanners that the domain hosts phishing content. No additional evidence links were supplied.

The certainty of the phishing nature is strong: the page title, Safe Browsing flag, blocklist presence, and multi‑vendor detections all converge on credential harvesting. Uncertainty remains regarding the exact target of the credential collection, as the site does not expose a brand name or specific login interface in the captured metadata. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration attempts, and update detection signatures to include the observed nameserver pattern and IP address.