build-extn-coinbseex[.]pages[.]dev

The domain build-extn-coinbseex.pages.dev was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the IP address 172.66.47.23 belonging to AS13335 (Cloudflare, Inc.) in the United States. HTTP requests to the host return a 403 status code and the page title reported by the server is "Suspected phishing site | Cloudflare," indicating that the site has been taken offline or is being blocked by Cloudflare’s protective mechanisms. The SSL certificate presented is issued by Google Trust Services under the WE1 hierarchy, confirming that TLS termination is handled by a legitimate certificate authority. Security telemetry shows that 13 of 93 vendors on VirusTotal have flagged the domain, and Google Safe Browsing classifies it as a social engineering threat.

Independent blocklist monitoring records the domain on a single security blocklist, and it is explicitly listed as blocked by PhishDestroy. Additional reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The site is identified as a credential phishing operation, though the specific target brand or credential type is not disclosed in the available data. Detected technologies include HSTS, Cloudflare services, and HTTP/3, all of which are typical for domains hosted on Cloudflare's network.

The nameservers deborah.ns.cloudflare.com and yisroel.ns.cloudflare.com further confirm the hosting arrangement. While the site is currently offline, its recent creation date, presence on multiple security feeds, and low trust score suggest it was active for a short period before takedown. Defenders should ensure that any outbound traffic to 172.66.47.23 is blocked, update intrusion detection signatures to include the domain and its associated IP, and monitor for any future re‑use of the same Cloudflare nameservers or similar sub‑domains.