page-coin-en-signin[.]pages[.]dev

Analysis of page-coin-en-signin.pages.dev shows a newly registered sub‑domain (created 21 Feb 2026) that resolves to 188.114.96.3, an address owned by AS13335 Cloudflare, Inc. in the United States. The domain is hosted behind Cloudflare’s edge service; its authoritative nameservers are jade.ns.cloudflare.com and anuj.ns.cloudflare.com, and the site presents HSTS and HTTP/3 support. A valid SSL certificate issued by Google Trust Services (WE1) is present, but the certificate alone does not attest to legitimacy. The HTTP response returned a 403 status code, which aligns with Cloudflare’s default “Suspected phishing site” block page, as reflected in the page title “Suspected phishing site | Cloudflare”.

Reputation data is uniformly negative: Gridinsoft assigns a trust score of 0 / 100, and VirusTotal records 12 detections out of 93 scanned security vendors. The domain is listed on a single public security blocklist and has been actively blocked by PhishDestroy. The classified threat is credential phishing, though no specific target brand or phishing page content has been disclosed. Current status shows the site taken offline, limiting immediate exposure but indicating that the infrastructure was operational at some point.

Uncertainty remains around the exact payload, credential harvesting mechanism, and whether additional sub‑domains share the same infrastructure. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the same IP or Cloudflare nameserver patterns, and incorporate the observed indicators (IP 188.114.96.3, Cloudflare nameservers, 403 block page, Gridinsoft score, VirusTotal detection count) into threat‑intel feeds. Periodic re‑scans are advisable to detect any re‑activation, and alerts should be generated for any new domains registered under the same registrar or sharing the same hosting profile.