Analysis indicates that the domain coincapmarketvoteverification-io.netlify.app is actively involved in a high-risk phishing campaign as of July 28, 2026. This domain, hosted on Netlify's infrastructure, resolves to the IP address 63.176.8.218, though no nameservers are currently associated with it. The domain has been flagged by multiple security vendors, including PhishDestroy, MetaMask, and SEAL, and appears on three distinct security blocklists, signaling its malicious intent. Infrastructure analysis reveals that the domain is registered through Netlify, a platform commonly used for legitimate web hosting but also exploited for phishing due to its ease of deployment. The absence of nameserver records may suggest an attempt to obfuscate tracking or evade detection, though this is not conclusive evidence of malicious activity on its own.
The resolving IP, 63.176.8.218, has not been linked to other known malicious domains in the available data, but its association with this phishing campaign warrants further scrutiny. VirusTotal scans conducted by 91 vendors returned no detections at the time of analysis. However, the lack of detections does not confirm the domain's safety, as phishing sites often evade initial scans through rapid deployment or obfuscation techniques. The domain remains active, and its inclusion on multiple blocklists underscores the urgency for defenders to treat it as a confirmed threat.
Defenders are advised to block access to coincapmarketvoteverification-io.netlify.app at the network level and monitor for any attempts to access it from internal systems. Given its association with MetaMask and SEAL blocklists, this domain is likely targeting cryptocurrency users, though the exact mechanics of the phishing scheme are not yet analyzed. Organizations should also review logs for connections to the IP 63.176.8.218 and investigate any related activity.
Frankfurt am Main, DE
ChainPatrol
Web-Check 
SOCRadar 
LeakIX 
buzzyt.netlify.app 
metamask-download.com 
metamaskverifyweb3.com 