# coin-scan.net — MALICIOUS

> coin-scan.net is an active crypto drainer phishing domain impersonating Coinbase. Flagged by 6 of 95 VirusTotal vendors.

## Summary
PhishDestroy identifies coin-scan.net as an active crypto drainer phishing domain with an elevated risk rating. This domain is part of an ongoing campaign designed to deceive users into connecting cryptocurrency wallets under the guise of legitimate transaction scanning services. The infrastructure mimics coin-scanning utilities, a common tactic among crypto drainers to exploit victims during transactions.  The domain coin-scan.net was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP address 104.21.80.219. The domain was created on March 18, 2026, and currently holds a VirusTotal detection rate of 6 of 95 security vendors. The SSL certificate is issued by Let's Encrypt, which provides minimal assurance of legitimacy. Review of threat intelligence databases indicates limited historical reporting, suggesting a recently deployed campaign.  As of the date of this report, coin-scan.net remains active. Users are strongly advised to avoid interacting with this domain or any associated links. Verify website authenticity through PhishDestroy or trusted threat intelligence platforms before entering credentials or connecting wallets. Security teams should consider blocking the domain at DNS and firewall levels using the IP (104.21.80.219) and domain (coin-scan.net) indicators. Blocking NICENIC INTERNATIONAL GROUP CO., LIMITED email domains in registration contexts may also reduce future exposure. Continuous monitoring for similar domains is recommended due to the evolving nature of crypto drainer campaigns.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-03-18 15:50:04
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 104.21.80.219

## Detection Status
- VirusTotal: 6 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/3f6e4f2c-67a0-4c6e-b03f-da34674b20a9
- PhishDestroy: https://phishdestroy.io/domain/coin-scan.net/
- LLM endpoint: https://phishdestroy.io/domain/coin-scan.net/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/coin-scan.net/
Last updated: 2026-03-23