acc-coinbse-extnsion[.]pages[.]dev

The domain acc-coinbse-extnsion.pages.dev was observed on 23 July 2026 and is currently offline. Registration metadata indicate that the domain was created on 21 February 2026 through Cloudflare, Inc., and the authoritative name servers are lila.ns.cloudflare.com and mack.ns.cloudflare.com, both owned by Cloudflare. DNS resolution points to the IP address 172.66.44.206, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site returned HTTP status code 403 and advertised the page title “Suspected phishing site | Cloudflare”.

Transport‑layer analysis shows the use of HSTS and HTTP/3, and the TLS certificate is issued by Google Trust Services under the WE1 profile, confirming a valid HTTPS endpoint. Google Safe Browsing has classified the domain as a social‑engineering threat, and the domain appears on one external blocklist, specifically PhishDestroy, which has taken it down. VirusTotal reports that 12 of 93 scanned security vendors flagged the domain, indicating a consensus of malicious behavior. The Gridinsoft trust score is 0 out of 100, and the threat type is recorded as credential phishing.

No additional intelligence such as payload samples, phishing kits, or victim reports is available, so the exact content of the phishing landing page and the credential capture mechanism remain unknown. Defenders should block the domain and its associated IP address at perimeter and DNS filtering layers, monitor for any resurgence of the host under different subdomains, and update URL filtering rules to include the observed page title and certificate issuer. Security operations should also correlate login attempts to popular services with the observed domain pattern to identify potential credential compromise. Ongoing observation is recommended to detect possible re‑registration or reuse of the Cloudflare infrastructure for similar campaigns.