coinlist[.]de

Analysis of coinlist.de indicates that the domain was provisioned to host a generic phishing campaign targeting users of the CoinList platform. The site resolved to the IPv4 address 5.9.9.94, which is allocated to AS24940 Hetzner Online GmbH in Germany. HTTP responses were served by Apache HTTP Server on a Debian operating system, with server‑side scripting provided by PHP and client‑side libraries including jQuery. The presence of HTTP Strict Transport Security (HSTS) and a valid TLS certificate issued by Let’s Encrypt (certificate identifier E8) demonstrates that the operator attempted to present a seemingly legitimate HTTPS experience. Static content retrieved from the site contained the page title “coinlist.de jetzt kaufen!”, reinforcing the intent to lure German‑speaking visitors with a purchase‑oriented message.

No additional markup or branding information was captured, so the exact visual impersonation cannot be confirmed. The domain appears in a single external blocklist and was actively flagged by PhishDestroy, which has since taken the site offline. VirusTotal reports that 16 of 95 antivirus and URL‑reputation engines classified the domain as malicious, providing a moderate consensus of compromise. AlienVault OTX listed the domain in one threat‑intel pulse, adding an independent indicator of compromise. Reputation services assign a Gridinsoft trust score of 0 out of 100, indicating an extremely low confidence in the domain’s legitimacy.

The combination of a low trust score, multi‑vendor detections, and the observed hosting profile aligns with typical phishing infrastructure. Uncertainty remains regarding the exact phishing page layout, credential collection method, and whether any additional C2 infrastructure is associated with the same IP address. Defenders should add 5.9.9.94 and coinlist.de to network‑level deny lists, enforce TLS inspection to capture any residual traffic, and monitor Hetzner‑hosted address ranges for similar activity.