coinchief-user[.]com

Analysis of the domain coinchief-user.com indicates it is actively engaged in credential phishing targeting users of the CoinChief platform. Registered on May 31, 2026, through Gname.com Pte. Ltd., the domain resolves to the IP address 186.2.175.79, hosted on AS59692 (IQWeb FZ-LLC) in Belize. The page title, 'CoinChief Login | Account Access and Platform System State,' explicitly suggests an attempt to impersonate the CoinChief login interface, aligning with the credential phishing classification provided in available intelligence. Infrastructure analysis reveals the use of nameservers pns71.cloudns.net, pns72.cloudns.com, and pns73.cloudns.net, alongside detected technologies including jQuery, Hammer.js, and DDoS-Guard. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious domains. The domain is currently active, returning an HTTP 200 status, and has been flagged by three security vendors on detection platforms, though the specific nature of these detections remains unverified in this report. It appears on three security blocklists and is explicitly blocked by at least two specialized security tools. While the domain has been referenced in one AlienVault OTX threat intelligence pulse, further contextual details about the campaign or its operators are not available at this time. The registration age of approximately six weeks does not deviate significantly from typical phishing domain lifecycles. Defenders are advised to treat this domain as high-risk and prioritize blocking or monitoring access to it, particularly in environments where CoinChief or similar financial platforms are used. Additional investigation into the hosting infrastructure and associated domains may reveal broader campaign linkages.