cointrackingpro[.]live

The domain cointrackingpro.live is currently offline but exhibits several infrastructure characteristics that align with a delivery‑scam operation. Registration data shows the domain was registered through the MIT registrar and is associated with ASN 153568, which maps to NEW DHAKA HARDWARE in the United States. The domain resolves to the IP address 163.61.188.89, hosted on the same ASN, confirming a single‑point hosting footprint. Nameserver records point to vip1.cupisweb.com and vip2.cupisweb.com, both of which are commonly observed in other malicious domains and suggest use of a shared DNS service often leveraged by threat actors. The site lacks an SSL certificate, meaning any traffic would be unencrypted, a pattern frequently seen in delivery‑scam sites that rely on rapid, low‑cost deployment rather than user trust signals.

Threat intelligence feeds have flagged the domain on one security blocklist, and PhishDestroy specifically lists it as blocked, indicating that at least one reputable anti‑phishing organization has identified malicious activity. VirusTotal scans returned three positive detections out of ninety‑five scanners, providing additional vendor corroboration of suspicious behavior. The page title returned from the live server, "CoinTracking: The Crypto Tax Calculator & Portfolio Tracker," mimics a legitimate financial service, which is a common lure in delivery‑scam campaigns that aim to convince victims to provide personal or payment information under the pretense of a tax‑related service.

While the site is currently offline, the presence of the blocklist entry, the positive VirusTotal detections, and the use of a known malicious DNS provider collectively constitute concrete evidence of malicious intent. Uncertainty remains regarding the exact payload or the extent of victim interaction, as no content analysis is available. Defenders should continue to block the domain at network perimeter devices, add the associated IP address 163.61.188.