filecoin[.]love

The domain filecoin.love was registered through GMO Internet, Inc. on December 11, 2025 and is currently resolving to the IP address 172.104.149.86, which is announced by AS63949 and associated with an Akamai Connected Cloud hosting location in Germany. The site presents an HTTP 200 response and serves a valid Let’s Encrypt certificate (R13), indicating that TLS is correctly configured. Infrastructure analysis shows the web server stack is built on Nginx with OpenResty and enforces HTTP Strict Transport Security, suggesting an attempt to appear professional. The domain appears on a single security blocklist and has been flagged by PhishDestroy, reinforcing its malicious reputation.

VirusTotal scans report that eight of ninety‑five security vendors classify the domain as malicious, while Gridinsoft assigns a trust score of zero out of one hundred, reflecting a high confidence of abuse. The publicly visible page title is identical to the domain name, filecoin.love, and no additional content has been disclosed. Nameserver records point to hehua.ns.giantpanda.com and qizai.ns.giantpanda.com, both of which are commonly observed in malicious hosting setups. While the exact phishing payload or victim‑targeted brand has not been disclosed, the combination of a freshly created domain, low trust scores, multiple vendor detections, and active blocking indicates a high‑risk phishing operation.

Defenders should add filecoin.love to internal blocklists, monitor DNS queries for the associated IP and nameservers, and enforce outbound filtering for TLS connections to the domain. Continuous re‑scanning with VirusTotal and other multi‑engine services is advised to capture any evolution in the payload. Organizations using any cryptocurrency‑related services should treat any unsolicited communications referencing this domain as malicious and instruct users to avoid interaction.