coinprotocol[.]app

PhishDestroy has identified coinprotocol.app as a brand impersonation domain specifically targeting the Sei brand. This domain is currently offline, but its recent activity posed a significant threat to users who may have been tricked into believing it was a legitimate Sei-related service. The domain was created on March 03, 2026, and was registered through NiceNIC International Group Co., Limited, a registrar often associated with malicious domains. It resolved to IP address 188.114.97.3 and had no SSL certificate, which is a strong indicator of fraudulent intent. The page title was "Just a moment...", a common placeholder used by phishing sites to appear legitimate while loading malicious content. Security vendors on VirusTotal flagged this domain, with 2 out of 95 marking it as malicious, and it appears on one security blocklist. These technical indicators collectively suggest a coordinated effort to impersonate Sei and deceive users into disclosing sensitive information.

The domain coinprotocol.app was designed to mimic the Sei brand, likely aiming to steal login credentials or other personal data. The absence of an SSL certificate and the use of a generic page title are red flags that users should recognize. The domain's registration through NiceNIC and its recent creation date further underscore the suspicious nature of this site. With a risk level of elevated, this domain posed a credible threat to individuals and organizations associated with Sei. PhishDestroy recommends that users avoid interacting with any content from coinprotocol.app and ensure that their systems are scanned for any potential compromises if they have visited the site.

Currently, coinprotocol.app is offline, but users should remain vigilant as similar domains may appear in the future. It is crucial to verify the authenticity of any website claiming to represent Sei by checking official channels and using trusted links. If you have already entered any credentials or personal information on coinprotocol.app, change your passwords immediately and enable two-factor authentication on your accounts. Report any suspicious domains to relevant security authorities to help protect others from falling victim to such impersonation schemes.