secure-coenbesh[.]pages[.]dev

Analysis of the domain secure-coenbesh.pages.dev indicates a high-risk credential phishing campaign that was active until recently taken offline. The domain was registered through Cloudflare, Inc. on February 21, 2026, and hosted on infrastructure associated with Cloudflare (AS13335), resolving to the IP address 172.66.47.90, located in the United States. The SSL certificate, issued by Google Trust Services (WE1), aligns with Cloudflare’s standard deployment practices, though this does not mitigate the domain’s malicious intent. Detection data reveals that the domain was flagged by 14 of 93 security vendors on VirusTotal, a modest but notable detection rate that suggests recognition of its phishing characteristics.

Additionally, the domain appears on at least one security blocklist, specifically PhishDestroy, and is classified as engaging in social engineering by Google Safe Browsing. Gridinsoft and Scamadviser both assigned the domain a trust score of 1/100, further corroborating its malicious classification. The page title, 'Suspected phishing site | Cloudflare,' reflects Cloudflare’s own automated detection and subsequent blocking, which returned an HTTP 403 status at the time of analysis. Infrastructure analysis reveals the domain’s nameservers as olivia.ns.cloudflare.com and corey.ns.cloudflare.com, consistent with Cloudflare’s hosting environment.

While the domain is currently offline, its prior activity and detection history indicate it was actively used for credential harvesting. The exact brand or service targeted by this campaign is not specified in available data, and no evidence of a specific phishing kit or additional infrastructure has been confirmed. Defenders should treat any prior interactions with this domain as compromised and monitor for related indicators of compromise, including the IP address 172.66.47.90 and associated Cloudflare nameservers.