conbseextnsion-eng[.]pages[.]dev

Analysis indicates that the domain conbseextnsion-eng.pages.dev was registered on February 21 2026 through Cloudflare, Inc. The authoritative nameservers are may.ns.cloudflare.com and gannon.ns.cloudflare.com, both operated by Cloudflare. DNS resolution points to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. The web service presented a HTTP 403 response and the page title returned by the server is “Suspected phishing site | Cloudflare”, consistent with a takedown page displayed by Cloudflare. The site employed HSTS and HTTP/3, and its TLS certificate was issued by Google Trust Services under the WE1 label, confirming a valid HTTPS configuration.

Security telemetry shows the domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. Google Safe Browsing classifies the URL as a social engineering threat, and Gridinsoft assigns a trust score of zero out of one hundred, indicating extreme risk. VirusTotal analysis recorded twelve detections out of ninety‑three scanners, reinforcing the malicious assessment. The identified scam type is credential phishing, targeting user credentials, although the specific victim brand or login portal has not been disclosed.

Defenders should continue to enforce blocklists that include this domain, monitor outbound traffic for connections to 188.114.97.3, and ensure that email gateways reject messages containing this URL. Because the site is currently offline, investigators should preserve any collected HTTP headers, TLS handshake data, and blocklist entries for future attribution. Ongoing observation of the associated Cloudflare account may reveal additional malicious domains that share the same nameserver set. In the absence of further content analysis, the available infrastructure evidence alone justifies a high‑risk classification and immediate mitigation.