tttkkkshowdemo[.]com

Analysis of tttkkkshowdemo.com, observed to be offline as of July 23 2026, indicates a confirmed brand‑impersonation campaign targeting Coinbase. The domain was registered through Gname.com Pte. Ltd. on 31 December 2025 and is hosted on Cloudflare’s network (ASN 13335, United States) at IP 104.21.72.212, serviced by the nameservers carla.ns.cloudflare.com and vasilii.ns.cloudflare.com. TLS termination is provided by a Google Trust Services certificate (WE1), and the site was delivering content over HTTP/3. The page title retrieved prior to takedown reads “Coinbase 钱包登录 - 跨平台解决方案”, aligning with the declared crypto‑scam typology and the impersonated brand “Coinbase”. VirusTotal scans returned 7 positive detections out of 93 security vendors, and the domain appears on a single public blocklist.

It has also been listed by PhishDestroy as a malicious entry. Defenders should treat the domain as hostile. Immediate actions include adding the FQDN to DNS‑based blocklists and updating web‑filter signatures to deny any HTTP(S) requests to the resolved IP address. Because the site leverages Cloudflare’s CDN, blocking the entire 104.21.72.0/24 subnet may reduce collateral impact, but a more precise rule against 104.21.72.212 can be employed. The Google‑issued TLS certificate confirms legitimate certificate issuance, but does not mitigate the risk; TLS inspection should continue to log any attempted connections.

Monitoring of newly registered domains under the same registrar (Gname.com Pte. Ltd.) and of additional Cloudflare‑hosted assets bearing similar page‑title patterns is advisable. Threat‑intel feeds that reference the 7 VirusTotal detections or the PhishDestroy listing can be tuned to generate alerts on future hits. As the site is currently offline, no payload or credential‑harvesting mechanisms have been observed; however, the presence of a Coinbase‑related title suggests a likely credential‑stealing login façade.