coinflowai[.]co

This domain, coinflowai.co, is identified as a high-risk crypto drainer phishing site designed to deceive users into connecting cryptocurrency wallets. Once connected, the site executes unauthorized transactions, draining funds from the victim’s wallet without consent. The threat targets users through fake login prompts or fraudulent transaction approvals, often mimicking legitimate crypto services to gain trust. Analysis indicates the domain was registered on April 28, 2026, through Dynadot Inc, a registrar commonly exploited for malicious infrastructure. It resolves to the IP address 56.69.16.222 and is flagged by 17 out of 95 security vendors on VirusTotal. Additional technical indicators include the use of Vue.js and Nginx, a Let’s Encrypt SSL certificate, and detection on three security blocklists. Google Safe Browsing has also classified this domain under SOCIAL_ENGINEERING, further confirming its malicious intent. If you visited coinflowai.co or interacted with its content, immediate action is required. Disconnect any connected wallets from the site and revoke all active sessions. Scan your device for malware using updated security tools, and monitor your wallet transactions for unauthorized activity. If funds were lost, report the incident to your wallet provider and relevant authorities. Avoid reusing passwords or recovery phrases associated with compromised accounts, and enable multi-factor authentication where possible to mitigate further risk.