divace-engg-coinbas[.]pages[.]dev

Analysis of divace-engg-coinbas.pages.dev indicates that the domain was registered through Cloudflare, Inc. on February 21 2026 and is currently taken offline. The site served a page titled “Suspected phishing site | Cloudflare” and returned HTTP 403, suggesting that access was blocked at the web server level. DNS resolution points to IP 188.114.96.3, an address owned by AS13335 Cloudflare, Inc. in the United States. The TLS certificate is issued by Google Trust Services under the “WE1” profile, confirming the use of a valid HTTPS endpoint. Google Safe Browsing has classified the domain as social engineering, and the site appears on one external security blocklist.

Cloudflare‑provided technologies observed include HSTS and HTTP/3, consistent with the hosting provider’s default configuration. A Gridinsoft trust score of 0 / 100 further corroborates a malicious reputation. VirusTotal analysis shows that 12 of 93 scanning engines flagged the domain, aligning with its designation as a credential‑phishing operation. The domain’s nameservers are mary.ns.cloudflare.com and mcgrory.ns.cloudflare.com.

PhishDestroy has already blocked the site. While the offline status limits immediate exposure, the combination of a recent creation date, a valid SSL certificate, and multiple detection signals suggests a deliberate credential‑phishing campaign. Defenders should continue to block the domain at network perimeter, monitor for any re‑hosting attempts, and update internal URL filtering lists. Additional scrutiny of any traffic that resolves to the same IP address is advised, as Cloudflare‑hosted infrastructure may be reused for other malicious actors.