coinpad[.]org

This domain, coinpad.org, is confirmed to be a cryptocurrency wallet phishing site targeting users seeking digital asset management platforms. Analysis indicates the site is designed to mimic legitimate wallet services, likely harvesting login credentials, seed phrases, or private keys from unsuspecting visitors. The infrastructure and naming convention strongly suggest an intent to deceive users into believing they are accessing a genuine wallet service, such as Coinbase Wallet or Trust Wallet, before redirecting or prompting for sensitive information. Evidence supporting this assessment includes multiple technical indicators. The domain was registered on May 11, 2025, through Squarespace Domains LLC, and is currently flagged by 2 out of 95 security vendors on VirusTotal. It appears on at least one security blocklist and is actively blocked by enterprise-grade threat intelligence feeds. The domain resolves to the IP address 198.185.159.144, a hosting provider commonly used for both legitimate and malicious sites. Technologies detected include Squarespace Commerce and HSTS, which may be leveraged to lend an appearance of legitimacy while obfuscating the true intent of the site. The page title, 'Coming Soon,' suggests the site is either in development or deliberately masking its operational status to evade detection. Users who have visited coinpad.org should take immediate action to mitigate potential risks. If any credentials, seed phrases, or private keys were entered, affected accounts must be considered compromised. Users should transfer any remaining assets to a new, secure wallet and revoke access from any connected applications or services. Devices used to access the site should be scanned for malware, and all passwords associated with cryptocurrency accounts should be changed. Additionally, users are advised to monitor transaction histories for unauthorized activity and enable multi-factor authentication on all related accounts. Given the elevated risk level, this domain should be blocked at the network level to prevent further exposure.