coin77bit[.]com

Analysis as of July 22, 2026 indicates that coin77bit.com is a newly registered domain (creation date February 21, 2026) that has been used to host a crypto‑related impersonation campaign targeting Metamask users. The site resolves to the IP address 104.21.65.14, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. The TLS certificate presented by the host is identified as “WE1”, but no further certificate details have been disclosed. The page title returned from the HTTP response is “77‑Bit”, which does not correspond to the Metamask brand and suggests a mismatch between the advertised content and the expected victim‑facing interface. The domain appears on two independent security blocklists.

PhishDestroy and ScamSniffer have both listed coin77bit.com as malicious, and the listing status is currently “offline”, indicating that the hosting service has taken the site down. VirusTotal analysis shows that one out of ninety‑three scanning engines flagged the domain, providing at least one independent detection of malicious activity. The site is classified as a “Crypto Scam” in the intelligence feed, consistent with the brand impersonation of Metamask. Despite the offline status, the infrastructure remains observable. The use of a Cloudflare edge IP suggests that the operators leveraged a widely trusted CDN to conceal the origin of the malicious payload.

No additional evidence such as Safe Browsing identifiers, OTX references, or registrar details were supplied, leaving the full attribution of the threat actor uncertain. The limited detection footprint (single vendor flag) may reflect the short lifetime of the site rather than a low‑risk profile. Defenders should add coin77bit.com to internal blocklists and monitor for any new domains that resolve to the same IP address or share the “WE1” certificate fingerprint.