faq-coenbase-pra[.]pages[.]dev

The domain faq-coenbase-pra.pages.dev was observed on 23 July 2026 delivering a suspected phishing page hosted on Cloudflare infrastructure. DNS resolution points to 172.66.47.97, an address owned by AS13335 Cloudflare, Inc. in the United States. The nameservers kimora.ns.cloudflare.com and rory.ns.cloudflare.com confirm that the domain is fully provisioned through Cloudflare’s registrar service, which also issued the SSL certificate signed by Google Trust Services / WE1. The site advertised HSTS and HTTP/3, indicating modern TLS configuration, but an HTTP 403 response was returned, suggesting that access was deliberately denied, likely after detection by the hosting provider.

The page title returned by the server is “Suspected phishing site | Cloudflare”, matching the classification of brand impersonation supplied in the intelligence feed. The domain was created on 21 February 2026 and has since been taken offline, yet it was listed on at least one security blocklist and was explicitly blocked by the PhishDestroy feed. Reputation services assign extremely low trust scores: Scamadviser 1/100 and Gridinsoft 0/100. VirusTotal analysis recorded 15 of 93 scanners flagging the domain as malicious, reinforcing the suspicion of phishing activity.

While the exact brand being spoofed is not disclosed in the available data, the combination of a freshly registered Cloudflare‑hosted domain, low reputation scores, blocklist presence, and multi‑vendor detections indicates a high probability of malicious intent. Defenders should add the domain and its resolving IP to deny‑list rules, monitor for any re‑registration attempts, and ensure that endpoint protection solutions are updated to flag the observed hash of the SSL certificate. Ongoing vigilance is advised because the underlying infrastructure (Cloudflare) may be reused for other abuse campaigns.