# PhishDestroy threat dossier — coinjoin.app ================================================================ Fetched: 2026-07-03 05:28:17 UTC Canonical: https://phishdestroy.io/domain/coinjoin.app/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Bitcoin Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: redirect_split) (score: 1/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 3/91 security vendors flagged this domain Flagging vendors: ESET, Gridinsoft, SOCRadar AlienVault OTX: 2 pulses (threat-intel feed mentions) Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 157.173.127.194 (FR, Lauterbourg) ASN: AS51167 Contabo GmbH Hosting org: Contabo GmbH Registrar: PublicDomainRegistry Nameservers: ["ns1.bitdomain.biz", "ns2.bitdomain.biz", "ns3.bitdomain.biz", "ns4.bitdomain.biz"] Page title: Bitcoin CoinJoin Mixer – Anonymous BTC CoinJoin Service ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / E8 Expires: 2026-07-18 Status: INVALID chain Fingerprint: 81e6fb6e9f29465c7d8afa080e4721bdd87eaccea79a84975a7d9d947e17767b Subject Alternative Names (related infrastructure — often same operator): - www.coinjoin.app ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-06-10 15:59:05 UTC (by PhishDestroy tracker) First reported: 2026-06-10 14:00:20 UTC (abuse notice filed) Last verified: 2026-07-03 07:16:46 UTC Neutralised: 2026-06-16 00:48:36 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019eb1d3-ee81-7244-a4ec-8d47b1a794dd/ URLQuery: https://urlquery.net/report/4630950c-5ac4-49c2-8c2c-6e47bc4f7611 Wayback Machine: https://web.archive.org/web/*/coinjoin.app crt.sh CT logs: https://crt.sh/?q=%25.coinjoin.app Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=coinjoin.app AlienVault OTX: https://otx.alienvault.com/indicator/domain/coinjoin.app URLhaus: https://urlhaus.abuse.ch/host/coinjoin.app/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-25 17:38:14 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain, coinjoin.app, is currently flagged as an active high-risk phishing site specializing in brand impersonation targeting Bitcoin. Analysis indicates the domain is designed to deceive users by mimicking legitimate Bitcoin CoinJoin mixing services, as evidenced by its page title, 'Bitcoin CoinJoin Mixer – Anonymous BTC CoinJoin Service.' The site is operational and poses a significant threat to individuals seeking privacy-enhancing cryptocurrency tools. Infrastructure analysis reveals the domain was registered through PublicDomainRegistry and resolves to the IP address 157.173.127.194. Security vendor assessments show that 3 of 95 engines on VirusTotal have flagged this domain as malicious. Additionally, the domain appears on three distinct security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Let's Encrypt (serial number E8), which, while providing encryption, does not validate the legitimacy of the site’s operations. No historical registration data or creation date was provided, but the active status and detection metrics confirm ongoing malicious activity. The current status of coinjoin.app remains active, and the risk level is classified as high due to its direct targeting of cryptocurrency users. Users are strongly advised to avoid interacting with this domain and to verify the authenticity of any cryptocurrency-related service through official channels. Network administrators should consider blocking the IP address 157.173.127.194 and implementing domain-based filtering to mitigate exposure. Cryptocurrency wallet providers and exchanges are recommended to monitor for transactions originating from or interacting with this domain and its associated infrastructure. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260610-C05FE5 Favicon MD5: b82e85980e40f394becd6e88123de5f3 TLS cert SHA-256: 81e6fb6e9f29465c7d8afa080e4721bdd87eaccea79a84975a7d9d947e17767b ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/coinjoin.app/ JSON API: https://api.destroy.tools/v1/check?domain=coinjoin.app Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 174,142 domains (13,604 alive under monitoring, 159,748 confirmed takedowns/dead). Site: https://phishdestroy.io