coinhako[.]me

This domain, coinhako.me, is identified as a high-risk credential theft operation targeting users of cryptocurrency exchange platforms. Analysis indicates the site is designed to harvest login credentials, private keys, and wallet recovery phrases under the guise of a legitimate exchange interface. The threat extends to potential financial loss through unauthorized access to digital assets, as the domain mimics trusted branding to deceive victims into disclosing sensitive information. Infrastructure analysis reveals the domain was registered on April 30, 2026, through NameCheap, Inc., a registrar frequently associated with malicious domains. It resolves to the IP address 104.21.57.172 and is flagged by 13 out of 95 security vendors on VirusTotal, indicating broad detection across the security community. The domain appears on four security blocklists, including MetaMask and PhishDestroy, and is categorized under SOCIAL_ENGINEERING by Google Safe Browsing. Additional indicators include a Let's Encrypt SSL certificate, which, while providing encryption, does not validate the legitimacy of the site. The domain has also been documented in one threat intelligence pulse on AlienVault OTX, further corroborating its malicious intent. Users who have visited coinhako.me or interacted with its content should immediately revoke any permissions granted to the site in their wallet applications. It is critical to change passwords for all cryptocurrency exchange accounts, particularly if credentials were reused across platforms. Enable multi-factor authentication where available and monitor accounts for unauthorized transactions. If private keys or recovery phrases were entered, affected wallets should be considered compromised, and funds should be transferred to a new, secure wallet. Users are advised to report the domain to their security providers and remain vigilant for follow-up phishing attempts via email or social engineering tactics.