coimbse-extension-browser[.]pages[.]dev

Analysis of coimbse-extension-browser.pages.dev indicates that the domain is being used for credential phishing. The site was registered on February 21, 2026 through Cloudflare, Inc., and its DNS is served by the Cloudflare nameservers journey.ns.cloudflare.com and lee.ns.cloudflare.com. The domain resolves to the IP address 172.66.47.204, which is owned by AS13335 Cloudflare, Inc. and geolocated to the United States. An SSL certificate issued by Google Trust Services (WE1) is present, confirming that HTTPS connections are terminated at the Cloudflare edge. HTTP requests return a 403 status code, and the page title returned is “Suspected phishing site | Cloudflare,” indicating that the content has been flagged by Cloudflare’s own anti‑abuse mechanisms.

The domain is listed on one external blocklist and has been actively blocked by the PhishDestroy service. Reputation services assign extremely low trust scores: Gridinsoft rates the domain 0/100, while Scamadviser gives it 1/100. Google Safe Browsing categorises the site as social engineering, and VirusTotal reports that 12 of 93 security vendors have flagged the domain as malicious. The overall assessment aligns with the declared scam type of credential phishing.

Defenders should add the domain and its resolving IP to blocklists, monitor DNS queries for the associated Cloudflare nameservers, and enforce outbound filtering for traffic to the IP range of Cloudflare edge nodes. Because the site is currently offline, ongoing observation of any re‑activation attempts is recommended. Indicators of compromise include the domain name, the two Cloudflare nameservers, the IP address 172.66.47.204, the SSL certificate issuer, and the 403 response code. Organizations using URL filtering, DNS sinkholing, or proxy inspection should ensure that requests to this host are denied to prevent credential harvest attempts.