coinbay866[.]com

On 24 July 2026 a technical assessment was performed on the domain coinbay866.com, which is currently taken offline. The domain was registered on 21 February 2026 and resolves to the IP address 104.21.12.26, an endpoint owned by Cloudflare, Inc. (AS13335) located in the United States. The site presents a page title of "Coinbase" and is classified as a crypto‑related scam that impersonates the Coinbase brand. VirusTotal analysis shows that 11 of 93 scanned security vendors flagged the domain as malicious, indicating a consensus among a subset of detection tools that the site is abusive.

The domain appears on a single external blocklist, specifically PhishDestroy, confirming that at least one security‑focused organization has taken protective action against it. An SSL certificate identified as "WE1" is associated with the domain, suggesting that encrypted HTTPS was in use when the site was active. No additional intelligence such as Safe Browsing, OTX, or registrar details was available.

The combination of a recent registration, Cloudflare hosting, multiple vendor detections, and a brand‑impersonating page title provides credible evidence that the domain was employed for a cryptocurrency‑focused social engineering campaign targeting Coinbase users. Because the domain is already offline, immediate containment is not required, but defenders should maintain the block in their DNS and web filtering solutions, monitor for any re‑registration attempts, and consider adding the domain to internal threat intel feeds. Ongoing vigilance is advised for other domains that use similar naming patterns or Cloudflare IP ranges, as adversaries frequently rotate infrastructure to evade detection.