alkjglkr[.]cc

The domain alkjglkr.cc was registered on November 16, 2025 through Dominet (HK) Limited and resolves to the IP address 104.21.23.114, which belongs to AS13335 Cloudflare, Inc. in the United States. Google Safe Browsing has classified the site as a social engineering threat, and AlienVault OTX references the domain in sixteen separate threat intelligence pulses, indicating recurring observation by the security community. VirusTotal analysis shows that seventeen of ninety‑five scanning engines have flagged the domain, reinforcing the suspicion of malicious intent. The site lacks an SSL certificate, and its authoritative nameservers are jill.ns.cloudflare.com and thaddeus.ns.cloudflare.com, both operated by Cloudflare.

The page title returned from the host is "Coinbase," matching the declared brand target and confirming the domain’s role in a brand‑impersonation campaign aimed at Coinbase users. The domain appears on one public security blocklist and has been specifically blocked by the PhishDestroy service, confirming its inclusion in active mitigation efforts. Current status is offline, which suggests the operator has taken the site down, but the underlying infrastructure—including the Cloudflare‑hosted IP—remains observable and could be repurposed for future campaigns.

Uncertainty remains regarding the exact content delivered to victims, as no additional page details or payload information were captured. Defenders should continue to block the domain and the associated IP address, monitor for re‑registration attempts, and incorporate the observed indicators—such as the registrar, nameserver pair, and detection counts—into threat‑intel feeds. Ongoing vigilance is advised to detect potential reuse of the same hosting resources in new impersonation attempts.