coin-flasher[.]net

The domain coin-flasher.net has been identified as a crypto drainer phishing site, specifically designed to deceive users into transferring cryptocurrency under the false pretense of a 'flash' or instant balance increase service. Analysis indicates this infrastructure targets holders of USDT, BTC, and potentially other digital assets by impersonating a legitimate cryptocurrency tool. As of the latest verification, the domain has been taken offline, though prior activity suggests a high-risk profile for financial fraud. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on February 21, 2026, resolving to the IP address 172.86.72.113. The site was flagged by 4 of 95 security vendors on VirusTotal, indicating detection by multiple threat intelligence sources. It appears on at least one security blocklist and has been actively blocked by enterprise-grade filtering systems. The page title, 'Coin Flasher App - Flash USDT, BTC & More,' directly references the fraudulent functionality promoted to victims. Technical indicators include the use of Nginx as the web server, Google PageSpeed for optimization, and support for HTTP/3, suggesting a relatively modern and maintained phishing infrastructure. The Gridinsoft trust score of 0/100 further corroborates the malicious nature of the domain. Current status confirms the domain is offline, though the underlying threat remains relevant due to the persistence of similar crypto drainer schemes. Organizations and individuals are advised to block the domain and associated IP at the network level, update endpoint protection signatures, and monitor for related indicators of compromise. Users should be educated on the risks of 'flash' or 'instant balance' tools, which are consistently associated with cryptocurrency theft. Financial institutions and crypto exchanges are recommended to flag any transactions linked to this domain or its infrastructure for potential fraud review.