coinstake[.]info

Analysis of coinstake.info indicates that the site was deployed to impersonate the cryptocurrency exchange Bitfinex. The domain resolves to the IP address 158.220.89.132, which belongs to Contabo GmbH in Germany (AS51167). Hosting is provided through the nameservers ns1.mysecurecloudhost.com and ns2.mysecurecloudhost.com, and the web server software is identified as LiteSpeed with support for HTTP/3. Front‑end libraries include jQuery and the live‑chat widget Smartsupp, confirming a typical commodity web stack rather than a bespoke phishing kit. The site presented the page title “coinstake.info”, and no additional content has been recovered; the current status is offline, preventing direct observation of the page layout or credential‑capture mechanisms.

The TLS certificate is a Let’s Encrypt R12 certificate, which offers only domain validation and does not imply any legitimate affiliation. Reputation services assign extremely low trust scores: Scamadviser rates the domain 1 / 100 and Gridinsoft also reports 1 / 100, reflecting a high probability of malicious intent. VirusTotal scans show that five out of ninety‑five antivirus engines flagged the domain, indicating that at least some security products recognize it as suspicious. The domain is listed on one public blocklist and is actively blocked by the PhishDestroy mitigation service.

Registration data shows the domain was created on 2023‑03‑31 under the TT registrar, linked to the same ASN (51167) used for the hosting provider, suggesting a rapid provisioning workflow common to opportunistic crypto scams. The combination of a reputable exchange brand name, low‑trust reputation scores, a disposable Let’s Encrypt certificate, and the presence on blocklists collectively point to a crypto‑related impersonation campaign targeting Bitfinex users. Defenders should continue to block the IP 158.220.89.