coqinu[.]net

On 27 February 2026 the domain coqinu.net was registered through NiceNIC International Group Co., Limited. The zone is hosted on Cloudflare, using the authoritative name servers noah.ns.cloudflare.com and tegan.ns.cloudflare.com, and resolves to the IP address 104.21.81.220, which belongs to AS13335 Cloudflare, Inc. in the United States. No SSL certificate is presented for the domain, indicating that HTTPS connections are not available. When accessed, the HTTP response returned the page title “Just a moment…”, but the site has since been taken offline. VirusTotal analysis shows that five of ninety‑three security vendors flagged the domain, suggesting a modest level of detection across the scanning community.

Independent reputation services have assigned a Gridinsoft trust score of 0 out of 100, and the domain appears on three public blocklists. The same blocklists—PhishDestroy, ScamSniffer, and Enkrypt—have explicitly listed coqinu.net as a malicious entry, confirming its classification as a phishing‑related resource. The available evidence supports the conclusion that coqinu.net was used for a generic phishing campaign. However, the lack of an SSL certificate and the minimal detection count leave uncertainty about the scale of the operation and the specific payload or credential‑harvesting technique employed. No additional indicators such as malware hashes, phishing page screenshots, or targeted brand references were observed in the current intelligence set.

Defenders should block DNS resolution to coqinu.net and add the associated IP 104.21.81.220 to network‑level deny lists. Monitoring for outbound connections to Cloudflare edge nodes that resolve to this address can help identify residual victim traffic. Organizations using URL filtering should ensure that the domain is included in their deny lists, and security teams should review recent logs for any HTTP requests to the domain before it was taken offline.