in-sing-coinbsa[.]pages[.]dev

The domain in-sing-coinbsa.pages.dev was created on February 21, 2026 and is registered through Cloudflare, Inc. The authoritative nameservers are vera.ns.cloudflare.com and dion.ns.cloudflare.com, indicating that the domain leverages Cloudflare’s DNS and edge services. Resolution points to IP address 172.66.47.20, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presented the page title "Suspected phishing site | Cloudflare" and served an HTTP 403 response before being taken offline, suggesting that access was deliberately blocked or the content was removed. TLS termination is performed by Google Trust Services under the WE1 certificate, and the connection employed HSTS and HTTP/3, consistent with modern Cloudflare configurations.

Security telemetry shows a Gridinsoft trust score of 0 out of 100 and presence on a single security blocklist. Ten of ninety‑three VirusTotal scanners flagged the domain, and the phishing indicator set PhishDestroy has already blocked it. The observed scam type is classified as Banking Phishing, although the specific financial institution targeted is not disclosed.

Current evidence confirms the infrastructure, but the exact payload, credential‑capture mechanisms, and any associated command‑and‑control hosts remain unknown. Defenders should continue to monitor the IP address 172.66.47.20 for any re‑use, enforce outbound filtering for known banking URLs, and ensure that security products reference the domain and its associated IP in blocklists. Because the site is offline, active takedown verification is not possible, but historical logs should be reviewed for any user interactions with the domain prior to its removal.