page-coinbse-extension[.]pages[.]dev

This domain, page-coinbse-extension.pages.dev, was identified as a credential phishing site and taken offline by July 25, 2026. Registered on February 21, 2026, through Cloudflare, Inc., the domain resolved to an IPv6 address (2606:4700:310c::ac42:2c51) within Cloudflare's network (AS13335). At the time of assessment, the site returned an HTTP 403 status, and Cloudflare's interstitial page labeled it as a 'Suspected phishing site.' Detection coverage was limited but notable: 14 of 93 security vendors on VirusTotal flagged the domain, and it appeared on one security blocklist. Google Safe Browsing classified the threat as social engineering, while Gridinsoft assigned a trust score of 0/100.

The SSL certificate was issued by Google Trust Services (WE1), and the domain employed HSTS and HTTP/3 technologies. Nameservers were hosted under Cloudflare (dion.ns.cloudflare.com, chin.ns.cloudflare.com). While the exact content of the phishing page remains unanalyzed, the available indicators—including the domain name, registration details, and detection flags—align with credential harvesting activity.

Defenders should treat this domain as malicious and prioritize blocking it at DNS, proxy, and endpoint layers. Historical logs should be reviewed for connections to the domain or its resolved IP, particularly from February to July 2026. No evidence suggests persistence, but monitoring for re-registration or similar domains under Cloudflare Pages is recommended.