coinme10090[.]cc

Analysis of the domain coinme10090.cc confirms its classification as a cryptocurrency phishing site, specifically targeting users associated with CME, as indicated by the page title 'CME'. The domain was registered on December 21, 2025, through Gname.com Pte. Ltd., a registrar frequently observed in fraudulent domain registrations. Infrastructure analysis reveals the domain resolves to the IP address 38.181.21.11, hosted under AS140227 (Hong Kong Communications International Co., Limited) in Hong Kong, a region commonly leveraged for bulletproof hosting. Detection data from July 24, 2026, shows that 9 out of 93 security vendors on VirusTotal flagged this domain as malicious, reinforcing its elevated risk level. The domain appears on two security blocklists, including PhishDestroy and ScamSniffer, further validating its fraudulent nature.

Gridinsoft assigns a trust score of 0/100, indicating no legitimate use case. The absence of an SSL certificate is a red flag, as encrypted connections are standard for legitimate financial or cryptocurrency platforms. Nameservers associated with the domain (a.share-dns.com, a7.share-dns.com, b.share-dns.net, b7.share-dns.net) are linked to other high-risk domains, suggesting a pattern of infrastructure reuse by threat actors. At the time of assessment, the domain is offline, which may indicate takedown efforts or temporary suspension by the hosting provider.

However, defenders should treat this domain as compromised and maintain blocking rules to prevent user exposure. While the exact content and phishing mechanics of the site remain unanalyzed due to its offline status, the combination of detection data, infrastructure indicators, and targeting of a financial entity (CME) confirms its malicious intent. Organizations are advised to monitor for related domains using the same nameservers or IP range, as threat actors often re-deploy infrastructure across multiple campaigns. No evidence of a phishing kit or specific lure type (e.g.