coinsair[.]com

The domain coinsair.com was a generic phishing site designed to deceive users into disclosing sensitive information such as login credentials or personal data. It did not impersonate a specific brand or employ a known crypto drainer kit. As of the latest verification, coinsair.com has been taken offline, though it previously posed an elevated risk to visitors.

Technical analysis shows that coinsair.com was flagged by 2 of 95 security vendors on VirusTotal, while Google Safe Browsing did not detect it as malicious. The domain appeared on 1 security blocklist (PhishDestroy) and was registered through NameCheap, Inc. on July 25, 2024. It resolved to the IP address 199.59.243.228, hosted on Amazon.com, Inc. infrastructure (AS16509) in the US. The SSL certificate was issued by GoDaddy.com, Inc. under the 'Go Daddy Secure Certificate Authority - G2' intermediate. Detected technologies included Node.js, Envoy, Express, HSTS, and Akamai. The page title observed was 'coinsair.com', and the domain used a single nameserver.

Users who interacted with coinsair.com should immediately change any passwords or credentials entered on the site, enable two-factor authentication (2FA) on all accounts, and monitor for unauthorized access or fraudulent activity. If financial or crypto-related information was exposed, consider revoking token approvals and transferring funds to a new wallet. Report the domain to platforms like Google Safe Browsing, PhishTank, or local cybersecurity authorities to aid in broader takedown efforts.