cointir[.]com

The domain cointir.com has been confirmed as a brand impersonation site targeting Ethereum, a major cryptocurrency platform. Analysis indicates the site was designed to mimic legitimate cryptocurrency exchange services, specifically presenting itself as a platform for buying and selling Bitcoin and Ethereum under the false brand name 'CryptoChange.' The domain is currently offline, but prior activity aligns with tactics used in cryptocurrency scams, including fake login portals and potential crypto drainer schemes. Technical indicators reveal the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolved to the IP address 172.67.143.173 and was flagged by 5 of 95 security vendors on VirusTotal. Additional intelligence sources include its presence in 2 AlienVault OTX threat pulses and listing on 1 security blocklist. Trust scores from Scamadviser and Gridinsoft were 15/100 and 0/100, respectively, further corroborating its malicious nature. The page title, 'Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | CryptoChange,' was crafted to deceive users into believing the site was a legitimate exchange. Current status confirms the domain has been taken offline, likely due to enforcement actions or takedown requests. However, the infrastructure and registration details suggest the operators may attempt to re-establish the threat under a different domain. Organizations and individuals are advised to block the domain and associated IP address at the network level. Users who interacted with the site should assume credential compromise and initiate account recovery procedures, including revoking access to any connected cryptocurrency wallets. Monitoring for similar domains registered through the same registrar or resolving to the same IP range is recommended to mitigate future risks.