sign-en-us-coinbse-io[.]pages[.]dev

Analysis of the domain sign-en-us-coinbse-io.pages.dev indicates it was actively involved in a credential phishing campaign prior to being taken offline. The domain, registered on February 21, 2026, through Cloudflare, Inc., utilized Cloudflare nameservers (brady.ns.cloudflare.com and maeve.ns.cloudflare.com) and resolved to the IP address 172.66.47.118, associated with AS13335 (Cloudflare, Inc.) in the United States. At the time of assessment, the domain returned an HTTP 403 status with the page title 'Suspected phishing site | Cloudflare,' reflecting its classification by Cloudflare’s internal security mechanisms. Infrastructure analysis reveals the use of HSTS and HTTP/3, alongside a Google Trust Services SSL certificate (WE1), which are common among phishing sites leveraging Cloudflare’s infrastructure to evade detection.

The domain was flagged by Google Safe Browsing for social engineering and appeared on at least one security blocklist. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. VirusTotal detections, as of the last scan, reported 9 out of 93 security vendors identifying the domain as malicious, though the absence of additional context limits the granularity of this assessment. The scam type was explicitly categorized as credential phishing, though the specific brand or service being impersonated remains unconfirmed due to the lack of detailed page content analysis.

Defenders should treat this domain as a confirmed phishing threat, particularly given its prior association with credential harvesting. While the domain is currently offline, organizations are advised to monitor for re-registration or similar domains leveraging Cloudflare’s infrastructure. Indicators such as the IP address, nameservers, and registrar details may aid in identifying related campaigns.