doc-star-coenbase[.]pages[.]dev

The domain doc-star-coenbase.pages.dev was created on February 21, 2026 and is hosted behind Cloudflare infrastructure (AS13335). DNS resolution points to IP 172.66.44.96, an address owned by Cloudflare in the United States. The site presented an HTTP 403 response before being taken offline, and the page title returned by the server was "Suspected phishing site | Cloudflare". Google Safe Browsing has classified the URL as a social engineering threat, and VirusTotal recorded 15 of 93 scanning engines flagging the host as malicious.

The SSL certificate is issued by Google Trust Services under the WE1 label, indicating a valid TLS endpoint, while HSTS and HTTP/3 are enabled, reflecting a modern web stack. The domain is registered through Cloudflare, Inc., and uses the authoritative name servers mack.ns.cloudflare.com and lia.ns.cloudflare.com. Reputation services have assigned a Gridinsoft trust score of 0 out of 100, and the site appears on a single security blocklist, having been blocked by PhishDestroy.

The listed scam type is Brand Impersonation, suggesting the domain was used to mimic a legitimate brand for credential harvesting. Defenders should immediately block the domain and its associated IP at perimeter defenses, enforce DNS sinkholing for future resolution attempts, and monitor for any re‑registration or related sub‑domains that may be leveraged in subsequent campaigns. Continuous querying of the IP and name server records is recommended, as well as incorporation of the domain into threat‑intel feeds to ensure downstream protection systems receive the indicator promptly.