ladqer[.]site

On 21 February 2026 the domain ladqer.site was registered via Atak Domain. The authoritative nameservers nico.ns.cloudflare.com and piper.ns.cloudflare.com resolve the domain to the IP address 172.67.141.137, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No TLS certificate is presented, indicating the site was served over plain HTTP. The only visible page title retrieved before takedown was “Enhance Your Beauty with Coinbase,” and the domain is explicitly linked to a brand‑impersonation campaign targeting Coinbase, classified as a crypto‑related scam. Threat intelligence feeds have listed ladqer.site on three security blocklists, and it is actively blocked by PhishDestroy, MetaMask, and SEAL.

VirusTotal analysis shows that two of ninety‑five antivirus engines flagged the domain, reinforcing the suspicion of malicious activity. The site’s current status is offline, and the risk rating has been assigned as elevated. Analysis confirms that the infrastructure is typical of fast‑flux or abuse‑of‑cloud services, using Cloudflare’s edge network to mask the true origin. The lack of SSL, combined with the deceptive page title, suggests the operator intended to lure users searching for Coinbase services.

However, the exact content of the landing page, any credential‑ harvesting forms, or additional payloads have not been captured, leaving those details unknown. Defenders should continue to block ladqer.site at network perimeter and DNS layers, monitor for any re‑registration attempts, and add the domain to internal allow‑list exclusions only after thorough verification. Continuous observation of the associated IP range (172.67.141.0/24) is advised, as Cloudflare customers frequently share the same address space. Incident response teams should also flag any outbound connections from internal hosts to this IP as suspicious and investigate potential compromise attempts related to Coinbase credential theft.