run-extesn-coinbse[.]pages[.]dev

Analysis of run-extesn-coinbse.pages.dev indicates a credential phishing operation hosted on Cloudflare Pages infrastructure, currently offline as of July 24, 2026. The domain, registered through Cloudflare on February 21, 2026, resolves to 172.66.44.73 (AS13335, US) and was flagged by 12 of 93 security vendors on VirusTotal. A Gridinsoft trust score of 0/100 and a single security blocklist entry further corroborate malicious classification. Google Safe Browsing categorizes the site as social engineering, while the page title 'Suspected phishing site | Cloudflare' suggests Cloudflare's own detection systems may have intervened.

The domain employs HSTS and HTTP/3, typical of Cloudflare-hosted properties, and uses nameservers mona.ns.cloudflare.com and steven.ns.cloudflare.com. SSL certification is provided by Google Trust Services (WE1). The HTTP 403 status at the time of assessment likely reflects takedown or protective blocking rather than benign configuration. Defenders should treat this domain as confirmed phishing infrastructure, particularly for credential harvesting.

While the exact brand impersonation remains unconfirmed, the scam type is explicitly credential phishing. Historical DNS and WHOIS records should be preserved for further investigation, and any observed connections to this domain should be investigated for credential compromise. The use of Cloudflare Pages infrastructure suggests potential abuse of legitimate hosting services for phishing operations.