coinslist[.]co

The domain coinslist.co was registered on February 21, 2026 through Tucows Domains Inc. It resolves to 188.114.96.3, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The site served a 404 Not Found page title at the time of collection and is presently taken offline. TLS termination is provided by Google Trust Services using the WE1 certificate, indicating a valid public‑issued certificate. Cloudflare’s DNS settings list ROCKY.NS.CLOUDFLARE.COM and ARIELLA.NS.CLOUDFLARE.COM as authoritative servers, and HTTP/3 is observed, which is consistent with Cloudflare edge hosting.

The domain appears on five external blocklists and has been flagged by multiple commercial detection services, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. VirusTotal reports three positive detections out of ninety‑three scanned engines, reinforcing the suspicion of malicious use. The classification in the supplied intelligence is “generic phishing”, but no specific target brand or lure content has been captured; the only visible artifact is the generic 404 title, indicating that the malicious landing page has been removed or never served. Uncertainty remains regarding the exact phishing payload, credential‑harvesting mechanisms, or any associated command‑and‑control infrastructure because no page content or traffic logs were observed.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the IP address or related Cloudflare‑hosted subdomains, and update endpoint protection signatures with the three VirusTotal detections. Because the domain uses a legitimate Cloudflare front‑end and a trusted Google certificate, standard reputation‑based blocking may be bypassed, so organizations should consider supplemental URL‑filtering rules that reference the identified domain name and its associated IP.