coimbse-extension-docs[.]pages[.]dev

Analysis of coimbse-extension-docs.pages.dev indicates that the domain was created on 21 February 2026 and is hosted behind Cloudflare’s network (AS13335) with the public address 188.114.96.3 located in the United States. DNS resolution points to Cloudflare‑provided authoritative nameservers journey.ns.cloudflare.com and nile.ns.cloudflare.com, confirming that the registrar is Cloudflare, Inc. The site served an HTTPS certificate issued by Google Trust Services under the WE1 root, and the TLS configuration includes HTTP/3 and HSTS enforcement. When accessed, the server returned HTTP 403, and the page title presented by the host was “Suspected phishing site | Cloudflare”, a default block page used by Cloudflare for domains flagged as malicious. Multiple external reputation sources have marked the domain as malicious.

VirusTotal recorded detections from 12 of 93 scanned security vendors, and Google Safe Browsing categorised the URL as social engineering, consistent with the observed scam type of credential phishing. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy. Independent trust‑scoring services such as Gridinsoft assigned a score of 0 out of 100, indicating extreme risk. The combination of a recent registration date, Cloudflare‑based hosting, a valid Google‑issued TLS certificate, and the presence of a default Cloudflare block page suggests that the infrastructure was deliberately provisioned to host a phishing lure and was taken offline after detection.

Uncertainty remains regarding the specific victim‑targeted brands or the exact phishing lures employed, as the content of the blocked page has not been captured. Defenders should continue to block the domain at perimeter filters, monitor for any re‑registration attempts, and add the associated IP address 188.114.96.3 to deny‑list rules.