coahux[.]com

This domain, coahux.com, is currently under investigation for hosting a crypto drainer phishing campaign. Analysis indicates the site is designed to impersonate legitimate cryptocurrency wallet recovery or management services, tricking users into connecting their wallets to malicious smart contracts that drain funds. The threat type is classified as a crypto asset theft operation, with no prior user reports of credential harvesting or traditional login phishing observed in initial scans. Infrastructure analysis reveals the domain was registered through NameSilo, a registrar frequently associated with low-reputation domains. As of the latest scan, coahux.com has 0/95 detections on VirusTotal, indicating it has not yet been flagged by security vendors. The domain resolves to the IP address 104.21.82.120, which is part of a content delivery network known for masking origin servers. SSL certificate inspection confirms the use of Google Trust Services, a common practice among threat actors to lend superficial legitimacy. No blocklist entries or trust score downgrades have been recorded at this time, though historical patterns suggest this may change as the campaign matures. Mitigation against this specific threat type requires heightened vigilance from cryptocurrency users. Individuals should avoid connecting wallets to unfamiliar sites, even if they appear to offer recovery or management tools. Wallet software should be updated to the latest version to ensure compatibility with built-in phishing protection features. Users who suspect interaction with coahux.com should immediately revoke any connected smart contract permissions via their wallet settings and transfer assets to a new, secure wallet address. Organizations managing crypto infrastructure are advised to preemptively block the domain and associated IP at the network level, pending further analysis.