coin-up8[.]top

coin-up8.top was registered on February 21, 2026 through Gname.com Pte. Ltd. The domain resolves to the Cloudflare edge address 104.21.64.1, which belongs to AS13335 Cloudflare, Inc. The authoritative nameservers are brianna.ns.cloudflare.com and scott.ns.cloudflare.com. TLS is provided by Cloudflare TLS Issuing ECC CA 3, and the site supports HTTP/3.

The site returns HTTP status code 200, but the page title reports “coin-up8.top | 522: Connection timed out”, indicating that the origin server is intentionally delaying or dropping connections. VirusTotal analysis shows that 3 of 95 scanned security vendors have flagged the domain, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on one public security blocklist and is listed as blocked by PhishDestroy.

Current intelligence classifies the domain as a high‑risk generic phishing operation, but the specific brand or service being spoofed has not been identified in public feeds. The presence of a valid Cloudflare certificate and normal HTTP response suggests the attackers are leveraging legitimate CDN infrastructure to mask malicious activity, making static content analysis difficult. No payload samples or malicious URLs have been publicly released, leaving the exact phishing lure and credential‑harvesting mechanisms uncertain.

Defenders should block DNS resolution to coin-up8.top at the network perimeter and add the IP address 104.21.64.1 to deny lists, recognizing that the address is shared among many legitimate Cloudflare customers. Monitoring for outbound connections to the domain and for HTTP/3 traffic to the Cloudflare edge can help detect attempts to reach the malicious front‑end. Organizations are advised to update email and web filters with the domain and to educate users about unexpected requests for cryptocurrency‑related credentials, as the domain name implies a possible financial lure.