extnsion-coin-bas-learn[.]pages[.]dev

Analysis of extnsion-coin-bas-learn.pages.dev shows a recently registered domain (created 21 Feb 2026) hosted on Cloudflare infrastructure (ASN 13335, IP 172.66.44.148, United States). The domain resolves to Cloudflare’s edge network and uses the provider’s SSL certificate issued by Google Trust Services (WE1). HTTP requests return a 403 status and the page title displayed by Cloudflare is “Suspected phishing site | Cloudflare”, indicating that the content has been taken down or blocked. Security monitoring indicates that the site has been flagged by 14 of 93 VirusTotal scanners, appears on one public blocklist, and is listed by PhishDestroy.

Google Safe Browsing classifies the URL as social‑engineering, and the Gridinsoft trust score is 0/100, reinforcing a high‑risk assessment. The registered name and nameservers (delilah.ns.cloudflare.com, lakas.ns.cloudflare.com) are owned by Cloudflare, Inc., confirming the hosting relationship. The identified scam type is credential phishing, though the specific target brand or credential collection page has not been disclosed. Uncertainties include the original content that prompted the Cloudflare “Suspected phishing site” title, as the domain is currently offline and no payload samples are available.

No additional indicators such as malware delivery, command‑and‑control traffic, or compromised credentials have been observed. Defenders should continue to block the resolved IP address and the domain at perimeter and DNS filtering layers, enforce strict outbound traffic controls to Cloudflare edge nodes, and monitor for any resurgence of the domain or similar sub‑domains. Given the high trust‑score negativity and multiple vendor detections, the domain should be added to internal blocklists and incident response playbooks for credential‑phishing campaigns. Ongoing threat‑intel feeds should be consulted for potential reuse of the same infrastructure in future operations.