Analysis of energy-coin.lat indicates active phishing infrastructure targeting cryptocurrency users. The domain was registered on July 28, 2026, through NAMECHEAP INC, with a creation window of three days prior to this report. It resolves to IP address 172.67.192.110, hosted behind Cloudflare nameservers ada.ns.cloudflare.com and arvind.ns.cloudflare.com.
While VirusTotal scans from 91 security vendors returned no current detections as of July 31, 2026, this absence does not confirm safety, particularly given the domain's recent registration and hosting on a shared IP commonly used for obfuscation. Two security blocklists—PhishDestroy and SEAL—have already flagged the domain, suggesting early detection by automated systems or user reports. The domain remains active with no observed takedown or sinkholing.
Defenders should treat this as a live threat and prioritize blocking at DNS, proxy, and endpoint layers. Further investigation is required to determine the exact phishing kit, targeted brands, or wallet-draining mechanisms, as no page title or brand intelligence is currently available. Network defenders are advised to monitor for connections to 172.67.192.110 and correlate with any cryptocurrency transaction anomalies.