colnilst[.]co

Analysis of colnilst.co indicates an active credential‑phishing campaign targeting CoinList users. The site resolves to IP 196.251.87.124, which geolocates to the Netherlands, and is hosted by Hosting Concepts B.V. d/b/a Registrar.eu. The domain was registered on 20 October 2025 and uses the parking nameservers ns1.dns-parking.com and ns2.dns-parking.com; no TLS certificate is presented, and the HTTP response returns status 200. The page title “Log in to CoinList” matches the declared scam type of credential phishing and the infrastructure is associated with the Token Presale phishing kit. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one security blocklist; PhishDestroy has already blocked it. VirusTotal scans show 13 of 95 security vendors flag the domain as malicious, reinforcing the risk assessment. Uncertainty remains regarding any additional back‑end infrastructure or victim interaction metrics, as no further forensic artefacts have been disclosed. Defenders should block DNS resolution for colnilst.co, enforce TLS inspection to catch the unencrypted HTTP traffic, and monitor for login credential submissions to CoinList that may originate from this host. Incident response teams should also consider updating internal phishing‑detection rules with the observed page title and IP address to reduce exposure.