brwser-extsion-coin[.]pages[.]dev

Analysis of brwser-extsion-coin.pages.dev shows a newly created domain (registered on February 21, 2026) that is currently offline but was previously serving a page titled “Suspected phishing site | Cloudflare”. The site resolves to the Cloudflare‑owned address 172.66.47.148, located in the United States under ASN 13335. Hosting is provided through Cloudflare’s infrastructure, with HSTS and HTTP/3 enabled and a Google Trust Services / WE1 SSL certificate terminating the TLS connection. The domain was flagged by seven of ninety‑three VirusTotal scanners, appears on one external blocklist, and is listed by PhishDestroy as a malicious entry.

A Gridinsoft trust score of 0 / 100 reinforces the low credibility assessment. The HTTP response returned a 403 status, indicating the site was deliberately inaccessible at the time of testing. Registration was performed via Cloudflare, Inc., using the default Cloudflare name servers sam.ns.cloudflare.com and pat.ns.cloudflare.com. The only confirmed malicious behavior is the classification as a credential phishing campaign, consistent with the page title and blocklist presence.

No additional technical artifacts such as malware payloads, command‑and‑control endpoints, or compromised credentials have been disclosed. Defenders should continue to block the domain at perimeter filters, monitor for any future resolution to the same IP range, and enforce credential‑reuse detection to mitigate potential credential harvesting. Ongoing observation of Cloudflare‑hosted domains with low trust scores and similar blocklist entries is recommended to capture re‑activation attempts.