support-extenstion-coinbs[.]pages[.]dev

The domain support-extenstion-coinbs.pages.dev was registered on February 21, 2026 and is currently taken offline, returning an HTTP 403 response. It is hosted behind Cloudflare’s network (AS13335) and resolves to the IP address 172.66.47.56, which is geolocated to the United States. The site is served with a TLS certificate issued by Google Trust Services under the WE1 identifier, and its authoritative nameservers are kaiser.ns.cloudflare.com and zara.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure.

Google Safe Browsing has flagged the domain for social engineering, and the page title presented by the server is "Suspected phishing site | Cloudflare," indicating that the content is being treated as a phishing placeholder. VirusTotal reports that 13 of 93 security vendors have flagged the domain, and it is listed on a single external blocklist. PhishDestroy has actively blocked the domain, while Gridinsoft assigns it a trust score of 0 out of 100, reflecting a high confidence of malicious intent.

The intelligence categorizes the activity as a tech‑support scam, a common vector where attackers impersonate support personnel to obtain credentials or payments. Defenders should add the IP 172.66.47.56 to deny‑list rules, monitor DNS queries for the domain and its Cloudflare nameservers, and ensure that endpoint protection solutions are updated to reflect the 13 vendor detections. Because the site is already offline, ongoing surveillance of newly resolved subdomains under the same Cloudflare account is advisable, as threat actors frequently reuse the same hosting profile for future campaigns.