coimbse-exteansion-doc[.]pages[.]dev

The domain coimbse-exteansion-doc.pages.dev was registered on 2026-02-21 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.47.20, which is announced by AS13335 in the United States. The site presents the page title “Suspected phishing site | Cloudflare” and returns an HTTP 403 status code, indicating that the content is being blocked or restricted. The SSL certificate is issued by Google Trust Services under the WE1 intermediate, confirming the use of a valid TLS chain but offering no indication of malicious content beyond the hosting context. VirusTotal analysis shows that 12 of 93 scanned security vendors have flagged the domain as malicious, and Google Safe Browsing classifies it as a social‑engineering threat.

The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy sinkhole service. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent. Authoritative nameservers are riya.ns.cloudflare.com and aaden.ns.cloudflare.com, both belonging to Cloudflare’s DNS infrastructure. No publicly available page content or targeted credential details have been captured, so the exact phishing payload remains unknown.

Defenders should add the IP address 172.66.47.20 and the full domain name to outbound and inbound filtering rules, monitor DNS queries for the associated Cloudflare nameservers, and ensure that endpoint protection solutions include the VirusTotal detection signatures. Organizations using Google Safe Browsing or similar URL filtering should keep the domain on block lists. Continuous observation of Cloudflare‑hosted domains with low trust scores is advised, as the infrastructure can be reused for future credential‑phishing campaigns.