nav--sso--coinhelp--dcos[.]pages[.]dev

The domain nav--sso--coinhelp--dcos.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned IP address 172.66.44.252 (AS13335, United States). DNS resolution is served by igor.ns.cloudflare.com and oaklyn.ns.cloudflare.com. An HTTPS connection presents a Google Trust Services / WE1 certificate and the site advertises HSTS and HTTP/3 support, indicating modern Cloudflare infrastructure. HTTP requests return status code 403 and the page title is "Suspected phishing site | Cloudflare", which is the standard Cloudflare block page for reported phishing content.

The domain is listed on one security blocklist and has been actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal analysis shows that 13 of 93 antivirus and URL‑reputation engines flag the domain as malicious, reinforcing the suspicion of credential‑phishing activity. The site’s current status is offline, suggesting that the phishing content has been removed or the hosting was taken down.

Open questions remain regarding the specific credential‑stealing payload, target brand, or victim demographics, as no additional content or URL paths have been captured. Defenders should immediately block the domain at the DNS and proxy layers, add the IP 172.66.44.252 to deny lists, and monitor for any resurgence of the same hostnames or similar sub‑domain patterns on Cloudflare. Continuous re‑scanning of the domain and its IP address is advised to detect any re‑activation, and security teams should correlate any login attempts or credential submissions with this indicator to prevent credential compromise.