coinjoin[.]site

PhishDestroy identifies coinjoin.site as a generic phishing domain leveraging the CoinJoin cryptocurrency mixing service to deceive users. This domain is part of a broader campaign targeting individuals seeking privacy-focused Bitcoin transactions. The site likely employs a crypto drainer kit designed to siphon funds from unsuspecting victims' wallets during transaction signing processes.

Domain registration details reveal coinjoin.site was created on February 11, 2026, through NameCheap, Inc., resolving to IP 193.201.15.249. VirusTotal flags this domain with a minimal detection score of 1/95 security vendors, indicating low but present malicious activity awareness. The domain utilizes a Let's Encrypt SSL certificate, a common tactic to appear legitimate. No Google Safe Browsing (GSB) status or blocklist counts are provided, suggesting recent emergence or minimal historical reporting.

As of current analysis, coinjoin.site remains active with an elevated risk level. Users are advised to avoid interaction and verify domain safety via PhishDestroy's threat database. The low VT detection score underscores the need for proactive threat intelligence, as this domain could evade traditional security measures. While no widespread attacks are confirmed, the combination of a newly registered domain and crypto drainer infrastructure poses significant risks to cryptocurrency users.