coin-tw[.]org

This domain, coin-tw.org, is currently under investigation for cryptocurrency phishing activity. Analysis indicates the site mimics legitimate cryptocurrency exchange or wallet services, likely targeting users with credential harvesting or wallet-draining schemes. No specific brand impersonation or drainer kit has been conclusively identified at this stage, though the domain name suggests an attempt to emulate trusted platforms. The page title 'Loading…' is a common tactic to delay detection while malicious scripts or redirects load in the background. Infrastructure analysis reveals the following technical indicators: the domain was registered on July 1, 2026, through Fewmoretaps OU d/b/a Trustname.com. It resolves to the IP address 104.21.44.140, which is associated with a content delivery network, potentially obscuring the true origin of the malicious infrastructure. As of the latest scan, the domain has a VirusTotal detection score of 0/95, indicating no security engines have flagged it as malicious. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. No listings on Google Safe Browsing or other major blocklists were observed at the time of analysis. The domain remains active and operational, with no takedown or mitigation efforts evident. Given the zero-detection status on VirusTotal, this campaign may still be in its early stages or employing evasion techniques to avoid automated detection. Users are advised to exercise extreme caution when interacting with this domain, particularly if prompted for wallet credentials or private keys. Organizations should monitor network traffic for connections to 104.21.44.140 and consider preemptive blocking of the domain. Further investigation is required to determine the full scope of the phishing kit, distribution methods, and potential victim impact.