coinfutures[.]eu

coinfutures.eu was registered on February 21, 2026 through IMMATERIALISM LIMITED and is hosted on Cloudflare's network (AS13335) with the IP address 104.21.32.187 located in the United States. The domain resolves to Cloudflare nameservers karl.ns.cloudflare.com and katelyn.ns.cloudflare.com. No TLS certificate was detected, indicating the site was served without HTTPS encryption at the time of analysis. The underlying platform is identified as WordPress running PHP with MySQL backend, enhanced by Redis object caching, Bootstrap front‑end framework, Yoast SEO and web‑vitals modules. The page title returned by the server is “CoinFutures: Crypto Futures Trading Platform | Leverage Trading”, which does not reference the impersonated brand.

The threat classification is brand impersonation targeting Apple, as indicated by the intelligence feed. Reputation services assign extremely low trust scores: Gridinsoft 0/100 and Scamadviser 1/100. The domain is listed on four security blocklists and has been actively blocked by PhishDestroy, MetaMask, ScamSniffer and SEAL. VirusTotal analysis shows two of ninety‑three scanners flagged the domain, confirming malicious intent.

The site is currently offline, which limits immediate interaction but does not remove the risk of re‑activation. Uncertainty remains regarding the exact phishing payload or credential‑capture mechanisms, as no page content beyond the title has been examined. Defenders should continue to block the domain at network perimeter, monitor DNS queries for the associated IP and nameservers, and add the domain to internal blacklists. Future investigations should request a full page capture to verify the presence of Apple‑related phishing elements and assess any command‑and‑control infrastructure that may be associated with the host.