coinconnected[.]site

The domain coinconnected.site was observed by multiple security services and is currently listed as an elevated‑risk phishing infrastructure. The site was registered on 24 December 2025 through HOSTINGER operations, UAB, and its authoritative nameservers are ns1.dns‑parking.com and ns2.dns‑parking.com. DNS resolution points to the IPv4 address 84.32.84.31, which belongs to AS47583 Hostinger International Limited and is geolocated in Lithuania. No TLS certificate is presented, indicating that the service operates without encryption.

The HTTP endpoint returned a page titled “Bot Verification” before the service was taken offline; the content of the page has not been captured, so the exact phishing payload remains unknown. VirusTotal analysis shows that three out of ninety‑three scanners flagged the domain, and four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—have added it to their deny lists. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious classification. Its appearance on four blocklists suggests that reputable anti‑phishing feeds have already identified the host as malicious, and the low detection count on VirusTotal does not diminish the threat given the limited scan coverage.

The lack of an SSL certificate further reduces trust and may be used to force victims onto unsecured channels. Because the site is currently offline, active exploitation cannot be confirmed, but the infrastructure remains reusable. Defenders should immediately block coinconnected.site at DNS and proxy layers, add the associated IP address 84.32.84.31 to network‑level deny lists, and monitor for any future resolution changes. Security operations should also consider updating URL filtering rules in web gateways to capture the “Bot Verification” title pattern, and employ threat‑intel feeds that reference the AS47583 network for broader coverage.