coldcard-devicenode[.]net

Analysis of coldcard-devicenode.net shows a newly registered domain (creation date July 31 2026) that is currently active and listed as a generic phishing threat. The domain resolves to the IPv4 address 190.123.44.82 and is served by the nameservers ns1cp82.panamaserver.com and ns2cp82.panamaserver.com, both associated with the registrar Hosting Concepts B.V. d/b/a Registrar.eu. Infrastructure inspection reveals no public SSL/TLS certificate details, and no page title or content has been disclosed, leaving the exact visual luring technique unverified.

The domain appears on a single security blocklist and is actively blocked by the PhishDestroy feed, indicating that at least one reputable anti‑phishing service has identified it as malicious. VirusTotal records show that the domain was scanned by 91 antivirus and URL‑reputation vendors, none of which flagged it at the time of scanning; this absence of detections is not interpreted as a safety signal, merely as a lack of current signatures. Given the recent registration, the hosting configuration, and the blocklist presence, the domain should be treated as a confirmed phishing site.

Defenders are advised to add coldcard-devicenode.net and its resolving IP 190.123.44.82 to network‑level deny lists, monitor the nameservers for any changes, and continue to track the domain on threat‑intel platforms for potential escalation. Because the site’s content has not been publicly harvested, any future changes to page titles or payloads should be re‑evaluated promptly. The current risk posture remains active and under investigation, warranting continued vigilance.