coaakcdc[.]top

The domain coaakcdc.top was registered on February 21, 2026 through NameSilo, LLC and currently points to the IP address 172.67.173.2, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The domain resolves via the Cloudflare nameservers elias.ns.cloudflare.com and tegan.ns.cloudflare.com, but it does not present an SSL certificate, indicating that HTTPS is not configured. A trust score from Gridinsoft rates the domain at 0 out of 100, the lowest possible rating, reflecting extreme suspicion. The page title returned from the site is "Coinbase", and the listed scam type is brand impersonation targeting the cryptocurrency exchange Coinbase.

Google Safe Browsing classifies the site as a social engineering threat, and fifteen of ninety‑three security vendors on VirusTotal have flagged the domain as malicious. The domain appears on three public blocklists and has been specifically blocked by PhishDestroy, MetaMask, and SEAL. The current operational status is offline, suggesting that the site has been taken down or is otherwise inaccessible at the time of analysis. While the infrastructure details—such as the use of Cloudflare’s network—are typical for many malicious sites seeking anonymity and resilience, the lack of an SSL certificate may indicate a hurried deployment.

Defenders should immediately add coaakcdc.top to internal block and detection rules, monitor traffic for any residual connections to the IP 172.67.173.2, and consider broader Cloudflare edge IP ranges in their threat‑intel feeds. Because the domain is already listed on multiple blocklists and flagged by major security services, further propagation is unlikely, but the underlying hosting arrangement could be reused for future campaigns. Continuous vigilance for new domains registered by the same registrar or using the same nameservers is recommended to pre‑empt re‑deployment of similar brand‑impersonation attempts.