docs-get-coinbs-extension[.]pages[.]dev

The domain docs-get-coinbs-extension.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.47.122, which belongs to Cloudflare’s AS13335 network in the United States. DNS resolution is served by the nameservers yew.ns.cloudflare.com and evelyn.ns.cloudflare.com, indicating that the infrastructure is fully hosted on Cloudflare’s edge platform. The site presents a Cloudflare‑generated page titled "Suspected phishing site | Cloudflare" and returns an HTTP 403 status code, suggesting that the content has been taken offline at the time of analysis. Security telemetry shows that the domain appears on a single security blocklist and has been flagged by PhishDestroy.

Google Safe Browsing classifies the URL as a social engineering threat, and VirusTotal reports 11 of 93 scanning engines flagging the domain, reinforcing the malicious assessment. The SSL certificate is issued by Google Trust Services under the WE1 identifier, confirming that the connection is encrypted but does not mitigate the underlying phishing intent. Additional telemetry includes a Gridinsoft trust score of 0 out of 100, reflecting a lack of reputation.

Detected web technologies comprise HSTS, Cloudflare services, and HTTP/3, all typical of Cloudflare‑hosted sites. Defensive operators should add the fully qualified domain name and its resolving IP address to outbound and inbound block lists, monitor for any new subdomains under the same registrar or nameserver pattern, and enforce web filtering policies that block URLs flagged by Google Safe Browsing and VirusTotal. Continuous threat‑intel feeds should be consulted for any resurgence, and incident response teams should be prepared to investigate any credential capture attempts that reference this domain.