explore-extensioncoinn[.]pages[.]dev

This domain, explore-extensioncoinn.pages.dev, was observed serving a page titled “Suspected phishing site | Cloudflare” and returned HTTP 403. The site resolved to IP 172.66.44.128, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The TLS certificate was issued by Google Trust Services under the WE1 label, indicating a valid HTTPS connection despite the malicious intent. The domain was registered through Cloudflare on 21 February 2026 and uses the authoritative nameservers jillian.ns.cloudflare.com and houston.ns.cloudflare.com. Infrastructure analysis shows the presence of HSTS, Cloudflare edge services, and HTTP/3 support.

Reputation services flag the domain as highly risky. Google Safe Browsing categorises it as a social‑engineering threat, and PhishDestroy has already blocked it. The domain appears on one public security blocklist, and VirusTotal reports that 13 of 93 scanning engines flag the host as malicious. Independent trust scores are extremely low: Gridinsoft assigns 0 / 100 and Scamadviser 1 / 100. The observed scam type is credential phishing, although the specific credential target is not disclosed in the available data.

Given the confirmed malicious classification, defenders should ensure the domain is added to DNS‑based blocklists and any network‑level URL filtering solutions. Continuous monitoring of the associated IP address and its Cloudflare‑hosted sub‑net is advised, as the attacker may re‑register similar domains within the same namespace. Incident response teams should also audit outbound traffic for connections to this domain and enforce sandbox analysis for any files that may have originated from it. Until further forensic evidence becomes available, the domain remains a high‑confidence phishing indicator and should be treated as hostile.