coin-free[.]top

On 23 July 2026, analysis of the domain coin-free.top revealed an active crypto‑scam infrastructure that was taken offline prior to this assessment. The domain was registered on 27 October 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and points to the IP address 104.21.5.192, which is hosted by Cloudflare (ASN 13335) in the United States. The authoritative name servers are byron.ns.cloudflare.com and stevie.ns.cloudflare.com. No TLS certificate was observed, indicating the site operated over plain HTTP. The page title returned by the server is “Coin‑free: Most Popular Online Crypto Casino Based on Blockchain”, aligning with the “Gambler Scam” phishing kit and the classification of a crypto‑scam.

VirusTotal reports that 13 of 93 scanned security vendors flagged the domain as malicious, confirming a consensus of detection across multiple AV engines. The domain is listed on a single security blocklist and has been manually blocked by the PhishDestroy service. Reputation services assign extremely low trust scores: Scamadviser rates the site 1/100 and Gridinsoft rates it 0/100, both indicating a high likelihood of fraudulent activity. The current HTTP status shows the site as offline, but the underlying infrastructure remains resolvable and could be re‑activated by the operators.

Defenders should continue to block the domain at the network perimeter, update URL filtering rules to include the host and its resolved IP, and monitor the associated Cloudflare name servers for any future DNS changes. Additional mitigation steps include adding the IP address to threat‑intel feeds, reviewing outbound traffic for connections to Cloudflare edge nodes that resolve to 104.21.5.192, and confirming that endpoint protection solutions incorporate the 13 VirusTotal detections. Because the site presently lacks an SSL certificate, attempts to enforce HTTPS will fail, providing a secondary indicator for detection.