welcome-coin-basse[.]pages[.]dev

Analysis shows that welcome-coin-basse.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. The domain resolves to the Cloudflare IP address 172.66.47.156, which is located in the United States and announced by AS13335 Cloudflare, Inc. The site was served over HTTPS using a Google Trust Services WE1 certificate and enforced HSTS, with HTTP/3 support observed. When accessed, the server returned an HTTP 403 status and presented the page title "Suspected phishing site | Cloudflare." The domain is presently taken offline, as indicated by its status flag. Infrastructure data reveal the authoritative nameservers kayden.ns.cloudflare.com and molly.ns.cloudflare.com. Reputation metrics are extremely low, with Scamadviser assigning a trust score of 1 out of 100 and Gridinsoft scoring 0 out of 100.

The domain appears on a single security blocklist, specifically PhishDestroy, and VirusTotal records indicate that 8 of 93 scanning vendors flagged the host as malicious. The classified scam type is credential phishing, though no specific target brand or credential set is disclosed in the available evidence. Uncertainties remain regarding the exact content that was hosted, the phishing lure employed, and whether any credential collection infrastructure was active before takedown.

Defenders should immediately add welcome-coin-basse.pages.dev to internal blocklists and ensure outbound traffic to the resolving IP 172.66.47.156 is denied or closely monitored. Continuous monitoring of the associated Cloudflare nameservers is advised to detect any re‑registration or re‑activation attempts. Correlate this indicator with existing threat‑intel feeds and update intrusion detection signatures to capture any future activity that may reuse the same infrastructure.