coinhelplive[.]pages[.]dev

Analysis of the domain coinhelplive.pages.dev indicates a high‑risk generic phishing profile. The site was registered on March 06 2026 through Cloudflare, Inc., and the domain resolves to IP 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 label, confirming the use of a valid HTTPS certificate despite the malicious intent. The page title returned by the server is "Suspected phishing site | Cloudflare," and the HTTP response code is 403, suggesting that the content is currently inaccessible because the site has been taken offline.

Google Safe Browsing flags the domain for social engineering, confirming the phishing classification. Independent security aggregators have identified the domain on three blocklists, and it is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows that nine of ninety‑four scanners have raised detections, reinforcing the malicious assessment. The domain’s Gridinsoft trust score is 0 out of 100, indicating no confidence in its legitimacy.

Nameserver configuration uses pablo.ns.cloudflare.com and teagan.ns.cloudflare.com, consistent with the registrar’s infrastructure. While the site is offline, the combination of a recent registration, Cloudflare hosting, a valid Google‑issued certificate, low trust score, multiple blocklist listings, and detection by several security vendors provides strong evidence of a phishing operation. Defenders should continue to block the domain at network perimeters, update intrusion‑prevention signatures, and monitor for any re‑activation attempts. Incident response teams should also correlate any observed traffic to the IP address 188.114.97.3 with internal logs to identify potential prior exploitation.