bountycoinmine[.]com

bountycoinmine.com was registered on February 21 2026 through GMO Internet Group, Inc. d/b/a Onamae.com. The domain resolves to the IP address 172.67.174.210, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. HTTP traffic was served by Nginx with the OpenResty module, and the TLS certificate presented is a GoDaddy Secure Certificate Authority – G2 issuance, indicating a valid, commercially‑obtained certificate. The only visible page title recorded before takedown was “$BOUNTY | Highest USDT Rewards”, suggesting an attempt to lure victims with cryptocurrency incentives.

The domain has been added to at least one security blocklist and is actively blocked by the PhishDestroy service. VirusTotal scans show that three of ninety‑three antivirus engines flagged the site, confirming malicious intent despite the low overall detection rate. Gridinsoft assigned a trust score of 0 out of 100, and the nameservers listed – ns1.verification‑hold.suspended‑domain.com and ns2.verification‑hold.suspended‑ – indicate that the registrar has placed the domain under verification hold, consistent with the current offline status.

The evidence points to a cryptocurrency‑focused phishing operation that is no longer reachable, but the underlying infrastructure – the Cloudflare‑served IP address and associated certificate – remains reusable for future campaigns. Defenders should continue to block the domain and its resolved IP, monitor for re‑registration or similar sub‑domains, and incorporate the observed page title and SSL fingerprint into detection signatures. Ongoing surveillance of the Cloudflare ASN for new malicious domains is also advised.