coin8ase-help24[.]pages[.]dev

The domain coin8ase-help24.pages.dev is currently listed as offline but remains flagged by multiple security entities. Registration data shows the domain was created on 21 February 2026 through Cloudflare, Inc., and its authoritative nameservers are mckenzie.ns.cloudflare.com and sterling.ns.cloudflare.com. DNS resolution points to the IP address 188.114.97.3, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. The site presents the page title “Suspected phishing site | Cloudflare” and serves an HTTPS certificate issued by Google Trust Services under the WE1 authority, with HTTP/3 and HSTS enabled. HTTP requests receive a 403 status code, indicating access denial.

Reputation checks reveal that the domain appears on three security blocklists and is blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows eight of ninety‑three scanning engines flag the domain, while Google Safe Browsing classifies it as social‑engineering. Gridinsoft assigns a trust score of zero out of one hundred. The identified scam type is credential phishing, consistent with the observed page title and the blocking actions taken by anti‑phishing tools. Uncertainty remains regarding the current activity level because the domain is reported as taken offline.

No additional payload details, landing page screenshots, or associated command‑and‑control infrastructure have been disclosed. Defenders should continue to block the domain at the network perimeter, monitor DNS queries for the IPv4 address 188.114.97.3, and enforce HTTPS inspection where possible to capture any residual traffic. Updating endpoint and web‑gateway threat feeds with the eight VirusTotal detections and the Google Safe Browsing flag will ensure automated controls trigger on future resolution attempts. Continuous observation of the Cloudflare nameservers for new subdomains is recommended, as attackers often reuse the same hosting provider for related campaigns.