scamcoin[.]network

Analysis indicates that the domain scamcoin.network is an active phishing resource targeting cryptocurrency users. Registered through Cloudflare, Inc., the domain resolves to 172.67.169.17, an address within Cloudflare's infrastructure (AS13335) located in the United States. The domain's nameservers, lovisa.ns.cloudflare.com and noel.ns.cloudflare.com, further confirm its reliance on Cloudflare's network services. As of July 12, 2026, the domain remains operational, returning an HTTP 403 status with the page title 'Just a moment...', a response commonly associated with Cloudflare's security challenges or interstitial pages. The domain is flagged by one security blocklist and is explicitly blocked by PhishDestroy. Detection engines on VirusTotal report three positive flags from a total of 95 vendors, suggesting moderate but not universal recognition of its malicious nature. The SSL certificate, issued by Google Trust Services (WE1), provides encrypted connections but does not mitigate the underlying threat. Infrastructure analysis reveals the use of Cloudflare Browser Insights and HTTP/3, technologies that may be leveraged to enhance evasion or user tracking. While the exact content of the phishing pages remains unanalysed, the domain name and available intelligence point toward a focus on cryptocurrency-related fraud. Defenders should treat this domain as high-risk and implement blocking measures at the DNS or network level. Given its active status and reliance on Cloudflare's infrastructure, monitoring for changes in resolution or certificate issuance may aid in tracking its evolution. No specific brand impersonation can be confirmed from the available data, and the threat classification remains generic phishing.