coinexplorer[.]cc

The domain coinexplorer.cc is identified as a crypto-focused phishing site designed to impersonate legitimate cryptocurrency explorer platforms. Analysis indicates this domain functions as a credential harvester and potential crypto drainer, targeting users attempting to access blockchain transaction data. The domain is currently offline, though prior activity suggests it was actively used in phishing campaigns. Infrastructure analysis reveals the domain was registered on March 28, 2026, through Dynadot Inc, an uncommon creation date that may indicate an attempt to evade detection. It resolves to the IP address 188.114.96.3 and is flagged by 17 of 95 security vendors on VirusTotal. The domain appears on one security blocklist and was previously detected in a single threat intelligence pulse. The SSL certificate is issued by Google Trust Services, which, while legitimate, is frequently exploited by phishing domains to appear trustworthy. Current status confirms the domain has been taken offline, though similar infrastructure may reappear under different names. Organizations and users are advised to block the domain and associated IP at the network level. Security teams should monitor for newly registered domains with similar naming patterns or infrastructure, particularly those impersonating crypto services. End-users should verify domain authenticity before entering credentials and enable multi-factor authentication on all cryptocurrency-related accounts.