coinstates[.]site

Analysis indicates that coinstates.site was registered on 24 September 2025 through Hostinger operations UAB and resolves to the IPv6 address 2a02:4780:42:fcc3:402d:a5b0:d6ee:fbd3, which is hosted by AS47583 Hostinger International Limited in Germany. The site does not present an SSL certificate, operating only over plain HTTP, and the page title returned by the server is “Home - Bigt3connectvault - A crypto buy and sell marketplace”, implying an attempt to masquerade as a cryptocurrency buy‑sell service named Bigt3connectvault. VirusTotal scans show three of ninety‑five security vendors flagged the domain, and six independent security blocklists have listed it. The domain is also blocked by PhishDestroy, MetaMask, Polkadot, SEAL and Enkrypt.

Authoritative name servers are ns1.dns-parking.com and ns2.dns-parking.com, typical of parked domains. The risk level was assessed as elevated because of the active phishing detection, reputable hosting provider, and lack of transport encryption. As of the report date the domain is offline, but historical evidence confirms its use in a phishing campaign targeting cryptocurrency users.

Defenders should deny any network traffic to coinstates.site, add the domain and its IPv6 address to local deny lists, and monitor for any future re‑activation on the same hosting infrastructure or similar naming patterns. Security teams should also consider URL filtering that inspects IPv6 destinations, as some controls focus only on IPv4. Additional scrutiny of other domains registered through the same registrar and using the same nameservers may reveal further malicious infrastructure.