coinbar796[.]com

Analysis of coinbar796.com indicates an active phishing domain targeting users of online gambling and betting platforms. The domain was registered on June 25, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to IP address 172.67.180.11, hosted on Cloudflare's infrastructure (AS13335). The page title, 'Coinbar: Yüksek Bahis Oranları, Canlı Bahisler, Casino Oyunları,' suggests the site impersonates a gambling or betting exchange, aligning with the 'Gambler Scam' phishing kit classification. SSL certification is provided by Google Trust Services (WE1), and detected technologies include PHP, React, Cloudflare Browser Insights, Google Tag Manager, and Google Analytics, which may be leveraged for tracking or obfuscation. The domain appears on one security blocklist and has been flagged in two AlienVault OTX threat intelligence pulses, reinforcing its malicious classification. VirusTotal reports three detections out of 91 security vendors, though this should not be interpreted as conclusive evidence of legitimacy or threat level. Gridinsoft assigns a trust score of 0/100, further indicating high-risk status. Nameservers (andy.ns.cloudflare.com, elsa.ns.cloudflare.com) and HTTP status 200 confirm the site remains operational as of July 12, 2026. Defenders should prioritize blocking or monitoring this domain, particularly in environments where gambling-related services are prohibited or pose a financial risk. The use of Cloudflare infrastructure may complicate takedown efforts, and the domain's recent registration suggests it may remain active for an extended period. Additional analysis of the phishing kit's payload or network behavior is recommended to identify further indicators of compromise.