coinbin[.]info

This domain, coinbin.info, is flagged as a high-risk crypto wallet drainer designed to harvest user credentials and execute unauthorized transactions from digital wallets. Analysis indicates the site employs a combination of credential theft and wallet-draining scripts, likely targeting users through deceptive interfaces mimicking legitimate cryptocurrency platforms. No direct brand impersonation was confirmed, but the infrastructure aligns with known wallet-draining kits observed in prior campaigns, including the use of ThinkPHP and Vue.js for dynamic content delivery. Infrastructure analysis reveals the domain was registered through Name.com Inc and resolves to the IP address 38.14.248.230. Security vendors on VirusTotal flagged the domain in 17 out of 95 scans, while it appears on three independent security blocklists. The domain is associated with two threat intelligence pulses in AlienVault OTX, further corroborating its malicious classification. Gridinsoft assigned a trust score of 0/100, and the domain was actively blocked by multiple browser-based security extensions prior to takedown. No creation date was provided, but the use of Nginx and PHP suggests a server-side infrastructure optimized for rapid deployment and evasion of detection. The domain is currently offline, having been taken down following reports from multiple threat intelligence feeds. However, the infrastructure components, including the IP address and associated technologies, remain active and may be repurposed for future campaigns. Users who interacted with the domain are advised to immediately revoke any connected wallet permissions, rotate credentials, and monitor transaction histories for unauthorized activity. Organizations should update blocklists to include the IP address 38.14.248.230 and monitor for recurring registrations under similar naming conventions. The remaining risk stems from the potential reuse of the server infrastructure for subsequent malicious domains.