coin-geckko[.]com

This domain, coin-geckko.com, is identified as a cryptocurrency wallet drainer phishing infrastructure designed to impersonate legitimate cryptocurrency tracking or exchange platforms. The site likely employs social engineering tactics, such as fake wallet connection prompts or fraudulent token airdrop claims, to trick victims into authorizing malicious smart contracts. Once connected, these contracts facilitate unauthorized transfers of digital assets from the victim’s wallet to attacker-controlled addresses, resulting in irreversible financial loss. The domain’s design and naming convention suggest an intent to mimic trusted services, increasing the likelihood of successful deception among cryptocurrency users.

Analysis of the domain’s infrastructure reveals multiple indicators of malicious intent. The domain was registered on February 21, 2026, through Tucows Domains Inc., a registrar frequently associated with phishing campaigns due to its accessibility and bulk registration capabilities. It resolves to the IP address 68.168.220.235 and uses an SSL certificate issued by GoDaddy.com, a common certificate authority that does not inherently validate the legitimacy of the domain’s content. Security vendors on VirusTotal flagged the domain as malicious, with 4 out of 95 engines detecting it as a phishing or fraudulent site. Additionally, the domain appears on four security blocklists, including feeds maintained by MetaMask, SEAL, PhishDestroy, and OISD. The page title, 'Index of /', further suggests misconfigured or intentionally exposed directory listings, a common trait in hastily deployed phishing infrastructure.

Users who visited coin-geckko.com or interacted with its content should take immediate remedial actions to mitigate potential risks. First, revoke any active wallet connections or token approvals granted to the domain via blockchain explorers or wallet management tools. Next, transfer remaining assets to a new, secure wallet and monitor transaction histories for unauthorized activity. If credentials or private keys were entered on the site, assume they are compromised and avoid reusing them. Report the domain to relevant security communities and consider notifying local cybersecurity authorities to contribute to broader threat intelligence efforts. Proactive monitoring of financial and digital identity accounts is recommended for at least 30 days following exposure.