cointed[.]io

cointed.io is currently offline but historical data indicates it was actively used as a brand‑impersonation site targeting Ethereum users. The domain was registered on 31 October 2025 through NiceNIC International Group Co., Limited and resolves to 172.67.195.144, an address owned by Cloudflare (AS13335) located in the United States. Both Gridinsoft and Scamadviser assign a trust score of 1 / 100, reflecting extreme lack of credibility. The site was listed on a single security blocklist and is blocked by PhishDestroy. Google Safe Browsing categorised the URL as a social‑engineering threat, and VirusTotal recorded 15 of 95 scanning engines flagging the domain, confirming malicious intent.

The page title “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | Cointed” suggests a cryptocurrency‑exchange façade, consistent with the reported scam type of a crypto scam and the explicit impersonation of the Ethereum brand. No SSL/TLS certificate was observed, meaning the site operated without encryption, which further aligns with typical phishing deployments. Nameservers naya.ns.cloudflare.com and nero.ns.cloudflare.com point to Cloudflare DNS, a common choice for fast‑fluctuating malicious infrastructure. Given the absence of a live host, investigators cannot retrieve current page content, HTTP response codes, or additional payloads.

However, the combination of low trust scores, blocklist presence, Google Safe Browsing flag, and multiple VirusTotal detections provides sufficient evidence to classify cointed.io as a high‑risk, brand‑impersonation domain. Defenders should continue to block the domain at network perimeters, update endpoint and DNS filtering policies, and monitor for any future re‑registration or resurrection of the host. Threat intelligence feeds that reference the IP 172.67.195.144 or the Cloudflare nameservers should be correlated to catch potential reuse.