thecoinb-se-lo-in[.]cc

This domain is flagged as a high-risk generic phishing threat targeting cryptocurrency users. Analysis indicates the infrastructure is designed to harvest wallet credentials, private keys, or sensitive financial data through deceptive interfaces mimicking legitimate platforms. The threat type is classified as crypto-specific phishing, with active campaigns observed as of the latest verification (seed cc1e3f). Infrastructure analysis reveals the domain thecoinb-se-lo-in.cc was registered on March 02, 2026, through NiceNIC International Group Co., Limited. It resolves to IP address 172.67.148.12, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain is currently active and lacks an SSL certificate. Security vendor detections on VirusTotal report 7/95 engines flagging the domain as malicious. It appears on three security blocklists and is explicitly blocked by at least three specialized threat intelligence feeds. Google Safe Browsing categorizes this domain as phishing, and the page title displays a Cloudflare warning: 'Suspected phishing site.' Mitigation steps for this threat type include immediate blocking of the domain and its resolving IP (172.67.148.12) at the network perimeter. Organizations should deploy endpoint protection rules to prevent access to the domain and monitor for any internal systems attempting to resolve or communicate with it. Users who may have interacted with the domain should revoke any active sessions, rotate credentials, and verify wallet integrity through offline tools. Security teams are advised to check proxy and DNS logs for connections to thecoinb-se-lo-in.cc or the IP 172.67.148.12 dating back to the creation date (March 02, 2026). Additional scrutiny should be applied to any outbound traffic to Cloudflare-hosted IPs associated with newly registered domains.