copperinu-cto[.]xyz

This domain, copperinu-cto.xyz, was registered on February 27, 2026, through NiceNIC International Group Co., Limited and is associated with generic phishing activity. Analysis indicates the domain was taken offline by July 25, 2026, though it previously resolved to 104.21.29.31, a Cloudflare IP (AS13335) located in the US. The domain uses Cloudflare nameservers (edna.ns.cloudflare.com, kevin.ns.cloudflare.com), a common infrastructure choice for phishing campaigns due to its ease of setup and privacy features. At the time of assessment, no SSL certificate was present, increasing the likelihood of interception or detection by security tools.

Detection data shows the domain was flagged by 2 of 93 security vendors on VirusTotal and appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The page title, 'Just a moment...', is consistent with Cloudflare's default interstitial page, suggesting the domain may have been caught in an early deployment phase or used as a redirector. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as high-risk. Defenders should treat this domain as part of a broader phishing infrastructure.

While the exact target or scam type remains unconfirmed due to limited content analysis, the combination of Cloudflare hosting, recent registration, and blocklist presence warrants inclusion in threat intelligence feeds and web filtering rules. If the domain reactivates, monitor for changes in SSL status, page content, or additional detections. No brand-specific indicators were identified in the available data.