conilst[.]co

Analysis of the domain conilst.co, created on 13 December 2025 and hosted behind Cloudflare (AS13335, United States), shows multiple indicators of active brand‑impersonation activity. The site returns an HTTP 301 redirect and serves a TLS certificate issued by Google Trust Services under the WE1 intermediate, confirming the use of legitimate‑looking HTTPS. The page title observed is "Rainbow Token Sale - CoinList," and the underlying phishing kit is identified as the Token Presale kit, a known template for crypto‑related credential harvesting. Google Safe Browsing flags the domain for social engineering, and 12 of 95 VirusTotal scanners have reported it as malicious, reinforcing the malicious intent.

Independent threat feeds corroborate the risk: the domain appears on two security blocklists (PhishDestroy, ScamSniffer) and is cited in one AlienVault OTX pulse. Reputation scoring from Gridinsoft is 0 / 100, indicating a lack of trust. The registrar listed is Web Commerce Communications Limited, and the authoritative nameservers are anirban.ns.cloudflare.com and cass.ns.cloudflare.com, both Cloudflare‑managed. The observed infrastructure—Cloudflare front‑end, HTTP/3 support, and an IPv6 address 2606:4700:3037::6815:69f—matches typical fast‑flux phishing deployments.

While the exact phishing landing page content has not been captured, the convergence of a brand‑specific title, a known token‑presale kit, and multiple vendor detections provides strong evidence of a credential‑stealing operation targeting users of the CoinList platform. Defenders should block conilst.co at the DNS and proxy layers, update web filtering rules to include the observed IP ranges, and monitor for similar token‑sale impersonation attempts. Continuous re‑scanning is advised to capture any changes in payload or hosting, and any observed credential submissions should be treated as compromised.