immediate-coar-500[.]com

Immediate-coar-500.com was registered on February 21 2026 through Name SRS AB and immediately pointed to the Cloudflare network (AS13335) at 172.67.185.75. The domain is served by the Cloudflare nameservers leland.ns.cloudflare.com and olivia.ns.cloudflare.com. No SSL certificate is presented, and the site currently returns an offline HTTP status, indicating that the payload is no longer reachable. The page title observed during the brief scan reads “Immediate Coar500 - Piattaforma Ufficiale | Trading IA 2025 | Oltre 10.000 Recensioni”, which suggests an attempt to masquerade as a trading platform and to lure victims with promises of artificial intelligence‑driven trading. The threat classification in the intelligence feeds is “Brand Impersonation” targeting the brand “base”. The domain appears on a single security blocklist and has been flagged by PhishDestroy.

Gridinsoft assigns a trust score of 0 / 100, reflecting a high likelihood of malicious intent. VirusTotal reported that 1 of 93 scanning engines flagged the domain, confirming the presence of at least one detection. AlienVault OTX lists the domain in one threat‑intel pulse, further corroborating its malicious reputation. Infrastructure analysis shows that the use of Cloudflare’s edge IPs is a common tactic to hide the true origin of malicious hosting. The lack of an SSL certificate may be due to the site being taken offline, but it also indicates that any future activation would likely rely on HTTP, which can be intercepted or altered. The presence of a brand‑impersonation label without additional contextual evidence means the specific content of the fraudulent page has not been fully captured; analysts should treat the page title as the only available indicator of the luring technique.

Defenders should block the domain and its associated IP address at perimeter firewalls and DNS filtering solutions.