secure-netcoiins-app[.]pages[.]dev

This report details a credential phishing threat identified at secure-netcoiins-app.pages.dev. The site displayed a page titled "Suspected phishing site | Cloudflare," indicating it was blocked by Cloudflare's security systems. The domain name incorporates a misspelling of "coin" and "app," suggesting it impersonated a cryptocurrency-related platform to deceive users into entering login credentials. The primary threat posed is credential theft, where victims risk having their account access stolen for malicious use.

Technical analysis confirms the malicious nature of the site. VirusTotal detected it as malicious with 15 out of 95 security vendors flagging it. Specific flags came from ADMINUSLabs, Criminal IP, alphaMountain.ai, BitDefender, and CyRadar. The domain was registered on October 13, 2025, through Cloudflare, Inc. The site resolved to IP address 172.66.44.115 located in the United States, hosted on AS13335 (Cloudflare, Inc.). SSL certificate was issued by Google Trust Services / WE1, and the nameservers were aurora.ns.cloudflare.com and edward.ns.cloudflare.com. The domain was listed on 2 blocklists.

As of the analysis, the site status is DOWN/OFFLINE, meaning it is no longer accessible. The GridinSoft trust score is 0 out of 100, indicating zero trustworthiness. The DOM risk score is 93 out of 100, signifying a very high risk level. This domain should be permanently blocked and monitored for any reactivation attempts.