coinvestra[.]com

This domain was observed on a single security blocklist and is currently listed as blocked by PhishDestroy. The domain coinvestra.com was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare address 172.67.192.42, which is associated with AS13335 Cloudflare, Inc. in the United States. The authoritative nameservers are armando.ns.cloudflare.com and zoe.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. No TLS certificate was presented at the time of analysis, so the site was reachable only via plain HTTP.

The page title returned by the server is “1 new message”, but no additional content has been captured, and the site was taken offline before a full content review could be completed. VirusTotal reports three detections out of ninety‑three scanners, confirming that at least a subset of security products recognize the domain as malicious. The classification supplied by the intelligence feed identifies the activity as an investment‑scam phishing campaign. Because the site is no longer reachable, direct forensic examination of the payload is unavailable, leaving the exact phishing vector and any harvested credentials uncertain.

Defenders should continue to block the domain and the associated IP address at network perimeters, add the host to internal threat‑intel feeds, and monitor for future registrations that reuse the same registrar or similar naming patterns. Given the Cloudflare infrastructure, threat actors may repurpose the same IP range for other campaigns, so traffic to AS13335 should be inspected for anomalous request patterns. Regularly updating URL filtering lists with the latest blocklist entries, including the PhishDestroy entry, will reduce the risk of accidental exposure. Continuous observation of the registrar’s activity may also reveal related domains that share the same creation window.