missilecoin[.]lol

missilecoin.lol is a newly registered domain (created 11 Mar 2026) that was observed hosting a generic phishing page titled “Un instant…”. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and delegated to Cloudflare’s DNS (amos.ns.cloudflare.com, maya.ns.cloudflare.com). DNS resolution points to 188.114.96.3, an IP address owned by AS13335 Cloudflare, Inc., geolocated to the United States. The site employed a Let’s Encrypt certificate (issuer “Let’s Encrypt / E7”), indicating HTTPS was available while the domain was active. Threat intelligence sources have repeatedly flagged the domain. AlienVault OTX lists it in eleven separate pulses, and three independent security blocklists contain it.

Commercial detection platforms have also marked the domain; VirusTotal recorded one positive detection out of ninety‑four scanners. The domain is currently listed as offline, and it has been blocked by PhishDestroy, MetaMask, and SEAL, suggesting that at least three anti‑phishing services have taken protective action. While the available data confirms the presence of a phishing page and a modest detection footprint, several details remain unknown. No public Safe Browsing verdict is provided, and the specific content or credential‑stealing mechanism of the page has not been disclosed. The exact target of the phishing lure is unclear, as the page title “Un instant…” does not reveal a brand or service.

Additionally, the short lifespan—less than five months between registration and takedown—prevents a fuller understanding of the campaign’s scale. Defenders should add missilecoin.lol to internal blocklists and monitor DNS queries for the associated Cloudflare nameservers. Because the domain resolves to a Cloudflare‑hosted IP, any future re‑use of the same IP address may indicate a shift in infrastructure, warranting continued observation.