ctradeinvestments[.]com

On July 25, 2026, security teams recorded activity associated with ctradeinvestments.com, a domain created on February 21, 2026 and presently taken offline. The site was hosted behind Cloudflare services (AS13335) and resolved to IP address 172.67.168.230, a location registered in the United States. Registration metadata shows the domain was provisioned through Cloudflare, Inc., and the authoritative name servers are brenda.ns.cloudflare.com and jobs.ns.cloudflare.com. The TLS certificate presented by the site was issued by Google Trust Services under the WE1 profile, and traffic was served over HTTP/3, confirming modern web stack usage.

Content analysis is limited to the observed page title, "Crypto Trade Investments - Home," which aligns with an investment‑scam classification. The domain explicitly impersonates the cryptocurrency exchange brand Coinbase. Threat‑intelligence aggregators have flagged the domain: six of ninety‑three VirusTotal scanners reported detections, Gridinsoft assigned a trust score of 0 / 100, and the domain appears on one security blocklist. It is also listed in a single AlienVault OTX pulse and has been blocked by the PhishDestroy service.

While the offline status prevents further probing, the combination of a brand‑impersonation claim, low trust score, multiple vendor detections, and inclusion on blocklists indicates a high likelihood of malicious intent targeting cryptocurrency investors. Defenders should continue to block the domain at network perimeter devices, monitor for related indicators such as the Cloudflare IP range and the specific name servers, and update detection rules to capture any re‑use of the underlying infrastructure. Ongoing observation of the IP address and associated SSL certificate is recommended to detect potential redeployment of the same hosting assets for future impersonation campaigns.