coraidexfinance[.]app

The domain coraidexfinance.app was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare name servers (bayan.ns.cloudflare.com, miki.ns.cloudflare.com). VirusTotal analysis shows that four of ninety‑five scanning engines flagged the domain, indicating a detectable malicious component despite the relatively low detection ratio. The site was listed on a single security blocklist and is actively blocked by the PhishDestroy service, suggesting that at least one anti‑phishing feed has identified it as hostile.

The page title returned by the server matches the domain itself, offering no additional context about the intended victim brand or lure. Current network probing reports the domain as offline, which aligns with the “taken offline” status noted in the intelligence feed. No further technical artifacts such as SSL certificate details, IP address ownership, or HTTP response codes have been disclosed, leaving those aspects of the infrastructure unverified.

Defenders should continue to monitor the domain for any re‑activation, ensure that outbound filtering rules include coraidexfinance.app, and propagate the existing blocklist entry across corporate web gateways. Incident response teams should also consider correlating any recent user reports of credential‑harvesting emails that reference finance‑related branding, as the domain name itself implies a financial theme that may be used in future phishing campaigns.