coinbee[.]icu

Analysis as of July 24 2026 indicates that www.coinbee.icu was registered on March 05 2026 through NiceNIC International Group Co., Limited. The domain resolves to 172.67.178.54, an address owned by Cloudflare, Inc. (AS13335) located in the United States. Two Cloudflare name servers – norman.ns.cloudflare.com and zariyah.ns.cloudflare.com – are authoritative. The site presented the page title "Buy Gift Cards with Crypto - Coinsbee," which aligns with a generic phishing classification.

No TLS certificate was observed; the service was reachable only via HTTP and is currently taken offline. VirusTotal scanned the host and recorded a single positive detection out of ninety‑five scanners, and the domain is listed on one public blocklist, where it was also flagged by PhishDestroy. These indicators collectively suggest the domain was used in a phishing campaign that likely lured victims into purchasing gift cards with cryptocurrency, a common monetization vector. Because the site is offline, content cannot be examined directly, leaving the exact payload and credential‑capture mechanisms uncertain.

Defenders should continue to block the domain at perimeter and DNS filters, add the IP address 172.67.178.54 to network‑level deny lists, and monitor the registrar NiceNIC for any re‑registration attempts. Updating intrusion‑detection signatures to include the observed page title and the specific nameserver pair will improve early detection of any future redeployment. Regular review of threat‑intel feeds for new detections related to this domain is recommended.