cointracker[.]ws

Analysis of cointracker.ws indicates an active phishing infrastructure targeting cryptocurrency users. The domain, registered on June 8, 2026, resolves to IP address 76.76.21.21 and is hosted on Vercel infrastructure with HSTS enabled. The site presents itself under the page title 'Cointracker,' suggesting an attempt to mimic legitimate cryptocurrency tracking or portfolio management services. Security vendors have flagged the domain, with 4 of 95 detecting it as malicious. It appears on four security blocklists and has been referenced in 16 threat intelligence pulses, indicating established malicious activity. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and phishing sites. Defenders should treat this domain as high-risk; blocking at the network level is recommended, particularly for organizations handling cryptocurrency transactions or user data. While the exact phishing mechanism remains unconfirmed due to lack of page content analysis, the combination of domain registration recency, cryptocurrency-themed branding, and security vendor detections strongly supports classification as active phishing infrastructure. Further monitoring of associated IP ranges and certificate issuance patterns may reveal additional linked domains.