get-coinbsextension-faq[.]pages[.]dev

The domain get-coinbsextension-faq.pages.dev was registered through Cloudflare, Inc. on 21 February 2026 and is hosted on Cloudflare's network (AS13335, United States). DNS resolution returns the IPv6 address 2a06:98c1:3120::3 and the site serves an SSL certificate issued by Google Trust Services (WE1). The page title returned by the server is "Suspected phishing site | Cloudflare", and the HTTP response code is 403, indicating the host is currently refusing access. Security‑engineered checks show that 13 of 93 VirusTotal scanners have flagged the domain, Google Safe Browsing lists it as a social‑engineering threat, and it appears on a single external blocklist.

PhishDestroy has also recorded the domain as blocked. The infrastructure presents HSTS, Cloudflare and HTTP/3 headers, confirming the use of modern CDN protections. Gridinsoft assigns a trust score of 0/100, reflecting a high confidence in malicious intent.

The observed behavior aligns with credential‑phishing activity, though the specific credential‑capture page content has not been captured. Defenders should continue to block the domain at network perimeter, update URL filtering rules, and monitor for any related subdomains or similar Cloudflare‑hosted assets created after the noted registration date. Because the site is currently offline, any ongoing campaigns may have shifted to new infrastructure; threat‑intel feeds should be consulted for emerging indicators of compromise.