multicoinslayers[.]live

The domain multicoinslayers.live is currently active and has been classified as a high‑risk credential‑phishing site. The site resolves to the IP address 188.114.97.3, which is announced by Cloudflare, Inc. and maps to the United States under ASN 13335. The domain is hosted behind Cloudflare’s edge network, as indicated by the presence of Cloudflare Browser Insights, Cloudflare service tags, and HTTP/3 support. TLS negotiation is performed using a certificate issued by Google Trust Services under the WE1 trust store, confirming that the connection is encrypted but does not imply legitimacy. The HTTP response code returned for the landing page is 403, while the page title presented to browsers reads “Nur einen Moment…”. The mail exchange (MX) record points to a sub‑domain “_dc-mx.6988b54f3b95.multicoinslayers.live”, suggesting a custom mail routing configuration that may be used for harvesting credentials. Reputation data shows that four out of ninety‑five security vendors on VirusTotal have flagged the domain, and the domain is listed on a single security blocklist. PhishDestroy has already added the domain to its blocklist, indicating that operational security tools have identified it as malicious. The Gridinsoft trust score of 0/100 further corroborates a lack of trustworthiness. Given the confirmed active status, the high risk rating, and the observed infrastructure, defenders should block the domain at network perimeter and enforce DNS sinkholing where possible. Continuous monitoring of the associated IP address and any newly observed sub‑domains is advised, as Cloudflare can dynamically re‑assign IPs. Organizations should also scrutinize inbound emails that reference the _dc‑mx sub‑domain, as they may be part of the credential‑collection workflow. Updating web filtering policies to include the domain and its associated IP will help mitigate exposure.