koinpark-login[.]com

Analysis of koinpark-login.com indicates that it is a credential‑phishing infrastructure targeting users of the Koinpark crypto exchange. The domain was registered on 22 October 2024 through NiceNIC International Group Co., Limited and is serviced by the authoritative nameservers pns51.cloudns.net and pns52.cloudns.net. DNS resolution points to the IPv4 address 185.149.120.107, which belongs to Autonomous System AS57724 operated by DDOS‑GUARD LTD and is geolocated in Russia. The site presented the page title “Koinpark Login & Koinpark Crypto Exchange | Koinpark Login Trading Platform,” confirming that the attacker is attempting to lure victims into entering credentials for a cryptocurrency trading platform.

No TLS certificate was observed, meaning the site was accessible only over HTTP, which further facilitates credential capture. VirusTotal recorded 13 detections out of 95 scanned engines, and the domain is listed on at least one public security blocklist. PhishDestroy has also added the domain to its blocklist, reinforcing the consensus that the domain is malicious. The current operational status is offline, preventing direct verification of the landing page, but the historical indicators are sufficient to classify the infrastructure as active phishing.

Defenders should immediately block DNS resolution to 185.149.120.107 and the domain name itself at the perimeter, update intrusion‑detection signatures to include the observed page title string, and monitor for any resurgence of the domain or related sub‑domains under the same registrar or nameserver set. Because the host resides on a DDOS‑GUARD network, additional scrutiny of traffic to that provider may be warranted. Continuous threat‑intel feeds should be consulted for any future re‑registration attempts or new indicators tied to the same infrastructure.