coinflipx402[.]fun

Analysis indicates that the domain coinflipx402.fun was registered through NameCheap on 31 October 2025 and is currently taken offline. The authoritative nameservers are hugh.ns.cloudflare.com and walk.ns.cloudflare.com, pointing to the Cloudflare network. DNS resolution returns the IP address 104.21.23.221, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. The site served an HTTP/3 endpoint protected by a Google Trust Services certificate (issuer WE1). The only observable HTTP response is the title “coinflipx402.fun | 522: Connection timed out”, suggesting that the server is not delivering content at the time of observation.

Gridinsoft assigned a trust score of 0 out of 100, indicating a highly untrusted rating. The domain appears on two public phishing blocklists, specifically PhishDestroy and ScamSniffer, and is listed on two security blocklists overall. VirusTotal records show that the domain was scanned by 95 AV engines, none of which reported a detection at the time of the scan. No additional intelligence such as OTX indicators, Safe Browsing entries, or malware kit attribution is available.

The combination of a recent registration date, zero trust score, presence on multiple phishing blocklists, and the lack of reachable content strongly suggests that the domain was intended for phishing or related malicious activity before being taken offline. Defenders should continue to block the domain at perimeter and DNS filtering layers, monitor for any resurgence of the same IP or associated Cloudflare nameservers, and consider adding the IP address 104.21.23.221 to internal blocklists if not already covered by existing cloud‑based filters. Ongoing vigilance is recommended, as the underlying hosting provider (Cloudflare) can be reused for future malicious campaigns. Until further evidence emerges, the domain should be treated as a high‑confidence phishing indicator.