houtai[.]newtucoinbase[.]top

On July 23, 2026 analysts observed that the domain houtai.newtucoinbase.top was taken offline but continues to be listed in multiple security feeds. The domain was registered on October 13, 2025 through Dominet (HK) Limited and resolves to the Cloudflare address 172.67.160.247, which belongs to AS13335 Cloudflare, Inc. in the United States. DNS resolution uses the Cloudflare authoritative nameservers rajeev.ns.cloudflare.com and zara.ns.cloudflare.com. No TLS certificate is presented for the host, indicating that HTTPS is not configured.

Google Safe Browsing flags the domain for social engineering, and fifteen of ninety‑five VirusTotal scanners have reported it as malicious. The site appears on a single external blocklist and has been actively blocked by the PhishDestroy service. A page title captured from an earlier snapshot reads “coinbase管理后台”, directly referencing the target brand Coinbase and confirming the intent to impersonate Coinbase’s administrative interface. The intelligence categorizes the activity as a crypto‑related scam.

Because the site is currently offline, direct content analysis is not possible, and the exact payload or credential‑harvesting mechanisms remain unknown. Nevertheless, the combination of brand impersonation, social‑engineering Safe Browsing flag, multiple vendor detections, and the observed page title provides strong evidence of malicious intent. Defenders should add houtai.newtucoinbase.top to URL filtering and DNS block lists, monitor the hosting IP 172.67.160.247 for any re‑use, and enforce TLS inspection to detect future attempts to serve content from this address. Continuous re‑scanning of the domain is advised in case it becomes active again, and any related traffic should be logged for further forensic investigation.