secure-coinmama[.]com

PhishDestroy identifies secure-coinmama.com as an active credential phishing domain targeting cryptocurrency users by mimicking the legitimate Coinmama platform. This domain employs a spoofed SSL certificate (Let's Encrypt) and deceptive domain syntax to trick victims into submitting login credentials or payment details. While no specific drainer kit was detected in this analysis, the domain architecture aligns with known phishing kits designed to harvest sensitive financial data under the guise of a crypto exchange service. The fraudulent domain preys on users seeking secure crypto transactions, leveraging brand confusion and urgency tactics.

This domain was flagged with a VirusTotal detection rate of 2/95 security vendors, indicating low initial detection but high potential for harm due to its targeted nature. It resolves to IP address 188.114.97.3 and was registered on May 11, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain's recent creation date and association with a reputable SSL provider (Let's Encrypt) suggest an attempt to appear legitimate while avoiding immediate blacklisting. Despite its low VT score, this domain poses an elevated risk due to its phishing-specific infrastructure and cryptocurrency-focused deception tactics.

As of current analysis, secure-coinmama.com remains active with no confirmed takedown actions. Users should immediately block this domain at network and browser levels, as it continues to pose credential theft risks. PhishDestroy recommends reporting this domain to threat intelligence platforms and updating browser-based phishing filters to prevent further victimization. While the immediate risk is elevated, the domain's low detection rate may increase as more vendors analyze its malicious behavior. Users interacting with crypto services should verify domains against official sources and enable multi-factor authentication on legitimate accounts to mitigate credential harvesting risks.