subcoin[.]click

PhishDestroy identifies www.subcoin.click as an active fake wallet-drainer host designed to trick users into surrendering private crypto keys and drain assets directly from their wallets. The domain presents itself as a legitimate ‘SubCoin’ wallet service but is a turnkey phishing package preloaded with JavaScript that automatically signs and executes unauthorized transactions once victims connect a wallet and grant a malicious signature request. Seed b7300f confirms this campaign is currently in the wild and not a generic phishing page but a specialized drainer kit marketed to cyber-criminals on dark-web forums. No known brand is being abused at this time, and the kit itself is proprietary rather than a cloned interface of an existing service. This domain was flagged on August 28 2024 and resolves to IPv4 address 46.62.172.27. The domain was registered through Hostinger operations UAB less than 48 hours ago, giving it an extremely young age profile which increases the risk of fresh malicious content. A Let’s Encrypt SSL certificate is already provisioned, likely to evade browser warnings and lend false legitimacy to phishing pages served under https://subcoin.click. VirusTotal currently shows 0 detections out of 95 engines, indicating the payload has not yet been widely fingerprinted. Google Safe Browsing (GSB) has no record for this domain, and public blocklists such as PhishTank and OpenPhish currently list zero entries for www.subcoin.click, underscoring the novelty and swift deployment of the threat. The current operational status is labeled active, meaning the drainer kit is live and potentially being pushed via spam, social media, or malvertising. Immediate defensive actions include blocking the domain at DNS and firewall layers, disabling inbound TLS connections to 46.62.172.27, and flagging the SHA-256 hashes of any wallet-drainer assets distributed from this host for endpoint blocking. Despite the young age and zero VT detections, the combination of a turnkey wallet-drainer package, recent registration, and lack of blocklist coverage places the residual risk at HIGH until widespread detection signatures emerge. Users should avoid any links mentioning SubCoin or similar crypto wallet services and treat unsolicited wallet connection prompts as hostile regardless of the domain’s SSL status.