coin-luxe[.]com

Analysis as of July 24, 2026 shows that coin-luxe.com is currently offline but retains an active infrastructure that matches a known brand‑impersonation campaign. The domain was registered through NameSilo, LLC on May 13, 2025 and resolves to IP address 172.67.132.164, which is part of AS13335 Cloudflare, Inc. located in the United States. No SSL certificate is presented for the host, indicating that any future activation would rely on plain HTTP or a later TLS deployment. The page title retrieved before takedown reads "Coin-Luxe - Swap | Trade | P2P | Ico | Coin-Luxe," and the site is explicitly flagged as impersonating the Ethereum brand.

VirusTotal analysis recorded a single positive detection out of 95 scanning engines, confirming that at least one security vendor identified malicious behavior. The domain appears on one public security blocklist and has been listed by PhishDestroy as a blocked entity. Reputation metrics are extremely low, with Gridinsoft assigning a trust score of 0 / 100 and Scamadviser reporting 16 / 100, both indicating a high likelihood of fraud. Nameserver configuration uses dara.ns.cloudflare.com and keaton.ns.cloudflare.com, consistent with the Cloudflare hosting profile.

While the site is offline, the underlying DNS and hosting remain under the control of the attackers, allowing rapid re‑deployment of phishing or credential‑harvesting pages. Uncertainties include the exact content of the removed pages, the phishing kit or scripts employed, and the scope of any victim data already harvested. Defenders should continue to block coin-luxe.com at the network perimeter, monitor the associated IP address for any new services, enforce TLS inspection on outbound connections to Cloudflare‑hosted IPs, and add the domain to internal threat‑intel feeds. Ongoing observation of newly registered domains that target the Ethereum brand is recommended to detect potential successor campaigns.