coinspot-en-help[.]pages[.]dev

This domain is flagged for elevated-risk brand impersonation targeting cryptocurrency users. Analysis indicates the site mimics CoinSpot, a legitimate platform for buying and selling Bitcoin, Dogecoin, and Litecoin, to harvest login credentials and sensitive financial data. The threat type is classified as brand impersonation with credential theft objectives, a common vector for cryptocurrency fraud and unauthorized fund transfers. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain coinspot-en-help.pages.dev, registered through Cloudflare, Inc., resolves to IP address 172.66.47.52 and was created on April 06, 2026. It appears on one security blocklist and is blocked by PhishDestroy. The domain holds a Gridinsoft trust score of 0/100, and VirusTotal reports 9 out of 95 security vendors flagging it as malicious. The SSL certificate is issued by Google Trust Services, which may lend false legitimacy to the site. The page title, 'CoinSpot Login — Buy & Sell Bitcoin, Dogecoin, Litecoin | CoinSpot 2025,' closely mirrors the branding of the legitimate CoinSpot exchange, increasing the likelihood of user deception. Mitigation steps for this threat type include immediate domain blacklisting at the network perimeter and endpoint levels. Organizations should update security policies to block domains hosted on Cloudflare Pages with similar naming patterns (e.g., [brand]-en-help.pages.dev). Users should be educated to verify domain authenticity by checking for HTTPS validity, examining SSL certificate details, and cross-referencing official brand communications. Cryptocurrency platforms should implement multi-factor authentication (MFA) and monitor for unusual login attempts from flagged infrastructure. Given the domain's current offline status, continuous monitoring for reactivation or similar domains is recommended, particularly those resolving to the same IP or using identical SSL certificates.