log-coinbsecom-enus[.]pages[.]dev

Analysis of log-coinbsecom-enus.pages.dev indicates that the domain is being used for credential phishing and is currently taken offline. The site was registered on February 21, 2026 through Cloudflare, Inc., and its authoritative nameservers are cruz.ns.cloudflare.com and graham.ns.cloudflare.com. DNS resolution points to the IPv6 address 2a06:98c1:3121::3, which belongs to the Cloudflare network (AS13335) located in the United States. The web server presents a Google Trust Services / WE1 SSL certificate and enforces HSTS, while also supporting HTTP/3, confirming the use of Cloudflare’s edge services.

An HTTP request returns a 403 status code and the page title is "Suspected phishing site | Cloudflare," confirming that the content has been flagged by Cloudflare’s protective layer. Threat intelligence shows the domain appears on one external security blocklist and is listed by PhishDestroy as blocked. VirusTotal scans report that 12 of 93 security vendors classify the domain as malicious, reinforcing the phishing assessment. Reputation services assign extremely low trust scores—Scamadviser 1/100 and Gridinsoft 0/100—indicating a high likelihood of fraudulent activity.

While the specific phishing landing page has not been captured, the combination of blocklist presence, vendor detections, low trust scores, and the Cloudflare‑generated warning page provides sufficient evidence for defensive action. Organizations should add the IPv6 address 2a06:98c1:3121::3 to network deny lists, block the domain at DNS filtering layers, and monitor for any future re‑registration attempts. Continuous threat‑intel feeds should be consulted for updates, and any credential capture attempts involving the domain should be treated as compromised.