coinbold-finex[.]com

This domain is flagged as a crypto drainer phishing site targeting cryptocurrency users through fraudulent partnership announcements. Analysis indicates an elevated risk level due to its infrastructure and detection patterns, suggesting intent to drain funds from connected wallets or steal private keys under the guise of a legitimate service. Infrastructure analysis reveals the domain was registered on July 02, 2025, through Sav.com, LLC, and resolves to the IP address 107.172.61.186. Security vendors on VirusTotal detect malicious activity, with 4 out of 95 flagging the domain. It appears on one security blocklist and is currently blocked by PhishDestroy. Trust scores from Gridinsoft and Scamadviser are 0/100 and 26/100, respectively, further indicating high-risk behavior. Technologies detected include LiteSpeed, Smartsupp, and HTTP/3, which are commonly used in both legitimate and malicious sites but align with patterns observed in crypto drainer operations. Mitigation steps for users include immediately disconnecting any wallets linked to this domain and revoking permissions via blockchain explorers or wallet management tools. Users should verify the legitimacy of partnership announcements through official channels only, as crypto drainers often impersonate exchanges or platforms to trick victims. If funds were transferred, report the incident to relevant blockchain forensics services and local cybercrime authorities. Network-level blocking of the domain and associated IP (107.172.61.186) is recommended for organizations to prevent access.