18p19p[.]xyz

18p19p.xyz is currently listed as offline but remains of interest to defenders. The domain was registered on 21 February 2026 and resolves to the IP address 172.67.191.8, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. All observed infrastructure components are hosted behind Cloudflare, including the Contentful CMS, Cloudflare Browser Insights and HTTP/3 support, indicating a typical abuse of a reputable CDN to hide the true origin of the malicious payload. The SSL certificate presented is identified as “WE1”, which is consistent with a Cloudflare‑issued certificate and does not provide additional authentication of the site owner.

Public threat intelligence shows that 12 of 93 security vendors on VirusTotal have flagged the domain, confirming a moderate level of confidence in its malicious nature. The site appears on a single external blocklist and has been explicitly blocked by the PhishDestroy feed, reinforcing the assessment that it is being used for a crypto‑related scam targeting Coinbase users. The page title returned from the server is “关于 Coinbase”, which directly references the target brand and aligns with the reported “Crypto Scam” classification.

Given the combination of a recent registration date, Cloudflare‑based hosting, a modest but non‑trivial detection count, and the presence on a known blocklist, the domain should be added to organization‑wide blocklists for both DNS and HTTP filtering. Security operations should also monitor traffic to the associated IP range (172.67.0.0/16) for any resurgence of activity, as threat actors frequently recycle Cloudflare IPs after takedown. Investigators should treat any future resolution of the domain as a potential credential‑harvesting or crypto‑drain attempt directed at Coinbase customers, and users should be warned that the URL is not an official Coinbase resource despite the Chinese‑language page title.