coinbaseltd[.]lu

On July 22 2026 analysts observed the domain coinbaseltd.lu, registered through Key-Systems GmbH on 21 February 2026. The domain resolves to IP 104.21.37.171, an address owned by AS13335 Cloudflare, Inc. and geolocated to the United States. DNS resolution is handled by raina.ns.cloudflare.com and finley.ns.cloudflare.com, confirming the use of Cloudflare’s authoritative name‑servers. The site presented a 404 Not Found page title, and the SSL certificate is issued by Google Trust Services under the WE1 identifier, indicating a valid TLS configuration despite the malicious intent. Security telemetry shows the domain appears on a single blocklist and is specifically blocked by PhishDestroy.

VirusTotal analysis recorded five detections out of ninety‑three scanned security engines, reinforcing the suspicion of abuse. Additional infrastructure fingerprints include Cloudflare Browser Insights and HTTP/3 support, both typical of Cloudflare‑hosted services. The domain is flagged as a crypto‑related scam that impersonates the Coinbase brand, aligning with the declared “Crypto Scam” classification. Current monitoring indicates the domain is offline, suggesting that the malicious content has been removed or the hosting has been terminated.

However, the infrastructure—particularly the Cloudflare edge IP and the registrar—remains reusable, and similar future campaigns could re‑activate the same domain or spawn new look‑alike domains. Defenders should add coinbaseltd.lu to domain deny lists, enforce DNS‑based blocking, and monitor Cloudflare‑hosted IP ranges for re‑use. Because the SSL certificate is valid, reliance on certificate trust alone is insufficient. Continuous threat‑intelligence feeds should be consulted for any re‑registration or resurrection of the domain, and any outbound connections to the associated IP should be scrutinized for anomalous activity.