coinlottery[.]org

This domain, coinlottery.org, is identified as a brand impersonation threat targeting Ethereum cryptocurrency users. Analysis indicates the site masquerades as a legitimate lottery platform, likely deploying a crypto drainer kit to siphon funds from victims' wallets. The page title, 'CoinLottery - Vinci ETH,' suggests an attempt to lure users with promises of Ethereum-based rewards, a common tactic in cryptocurrency scams. No direct evidence of a specific drainer kit is present in the available data, but the infrastructure aligns with known patterns of wallet-draining phishing campaigns.

Technical indicators reveal the domain was created on February 21, 2026, and is registered through Cloudflare, Inc. It resolves to the IP address 162.159.142.117, hosted on Google Cloud infrastructure with Cloudflare services. VirusTotal reports 2 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is secured with an SSL certificate issued by Google Trust Services. Technologies detected include HSTS, Google Cloud CDN, and Cloudflare Browser Insights, which are often leveraged to lend an air of legitimacy to phishing sites.

As of the latest assessment, coinlottery.org has been taken offline, likely in response to security vendor detections and blocklist inclusion. However, the infrastructure remains a residual risk, as threat actors frequently repurpose or re-deploy similar domains. Users who interacted with the site should immediately revoke any connected wallet permissions, monitor transaction histories for unauthorized activity, and consider migrating funds to new wallets if compromise is suspected. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.