coinsageaibd[.]com

This domain is identified as a crypto drainer phishing site targeting users of CoinSageAI, a cryptocurrency trading platform. The site is designed to deceive visitors into connecting their digital wallets, enabling malicious scripts to siphon funds without authorization. Victims are typically lured through fake promotions, airdrops, or investment opportunities advertised on social media or compromised forums. The domain mimics legitimate CoinSageAI branding, including logos, color schemes, and interface elements, to lower user suspicion and increase the likelihood of successful exploitation. Analysis indicates the domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 104.18.25.222, which is proxied behind Cloudflare, obscuring the true origin of the malicious infrastructure. The domain appears on one security blocklist and is flagged by 2 out of 95 security vendors on VirusTotal, with detections primarily categorized as phishing or malicious. The SSL certificate is issued by Google Trust Services, providing a false sense of security to potential victims. Gridinsoft has assigned a trust score of 0/100, further corroborating its malicious nature. Users who visited www.coinsageaibd.com or interacted with the site should immediately disconnect any linked wallets and cease all transactions. If a wallet was connected, it is critical to revoke any active smart contract approvals using a blockchain explorer or wallet management tool. Monitor wallet activity for unauthorized transactions and consider transferring remaining funds to a new, secure wallet. Report the incident to relevant cybersecurity organizations and the impersonated platform to aid in mitigation efforts. Enable multi-factor authentication on all cryptocurrency-related accounts and verify the legitimacy of any future investment opportunities through official channels only.