help-coenbase-login[.]pages[.]dev

help-coenbase-login.pages.dev was observed hosting a credential phishing page. The site returned HTTP 403, indicating access denial, and the page title displayed "Suspected phishing site | Cloudflare". The domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to 172.66.44.152, which belongs to AS13335 Cloudflare, Inc. in the United States. DNS is served by brian.ns.cloudflare.com and amy.ns.cloudflare.com. The TLS certificate presented is issued by Google Trust Services under the "WE1" name, confirming a legitimate certificate chain but offering no indication of malicious intent.

The site employed HSTS, Cloudflare services, and HTTP/3, all typical of modern hosting stacks. Reputation scoring from Gridinsoft assigned a zero out of one hundred, and VirusTotal recorded twelve detections out of ninety‑three scanned engines, reflecting a moderate level of malicious consensus. The domain appears on a single external blocklist and is actively blocked by the PhishDestroy feed. The categorization in the intelligence is "Brand Impersonation", aligning with the credential‑phishing threat type. At the time of analysis the domain was taken offline, matching the reported status.

No evidence was found regarding additional infrastructure, compromised credentials, or payload delivery mechanisms. The limited visibility of the actual page content prevents a full assessment of the lure employed, but the combination of a low trust score, multiple vendor detections, and active blocklist inclusion justifies an elevated risk rating. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration or related subdomains, and consider adding the IP address 172.66.44.152 to threat intelligence feeds. Ongoing observation of Cloudflare‑hosted phishing infrastructure is recommended, as attackers often recycle these resources.