coinholmes[.]com

Analysis of coinholmes.com, created on February 21, 2026, shows a domain that is actively serving content (HTTP 200) and is hosted behind Cloudflare’s network (AS13335, United States). The domain resolves to IP address 188.114.96.3 and uses Cloudflare‑provided authoritative nameservers gabriel.ns.cloudflare.com and heidi.ns.cloudflare.com. The site presents the page title “AML Solution for Digital Assets｜CoinHolmes,” suggesting a focus on anti‑money‑laundering services for digital assets, yet the intelligence classifies the operation as a crypto‑related phishing campaign. The domain appears on three public security blocklists and is specifically blocked by PhishDestroy, MetaMask, and SEAL, indicating that industry‑focused anti‑phishing tools have identified it as a threat.

VirusTotal analysis shows a single detection out of 93 scanning engines, reinforcing the presence of malicious indicators. The SSL certificate is issued by Google Trust Services under the “WE1” intermediate, confirming a valid TLS handshake but offering no protection against the underlying fraudulent activity. Additional infrastructure observations include the use of Google Analytics and HTTP/3, both typical of legitimate sites and therefore not useful discriminators. A Gridinsoft trust score of 0 / 100 further underscores the low credibility of the domain.

While the page title and technology stack suggest a veneer of legitimacy, the convergence of blocklist listings, the single VirusTotal detection, and the classification as a crypto scam point to a high‑risk phishing operation targeting cryptocurrency users. Uncertainty remains regarding the exact phishing vector (e.g., credential harvesting, malicious wallet redirects) because the page content has not been examined. Defenders should block the domain at network perimeter, monitor DNS queries for the associated Cloudflare nameservers, and add the IP address 188.114.96.3 to threat‑intel feeds.