coincorner[.]trade

A newly registered domain, coincorner.trade, has been identified as a fraudulent cryptocurrency exchange site masquerading as the legitimate CoinCorner platform. This domain poses a significant risk to users seeking legitimate crypto services, as it leverages deceptive branding to steal credentials and sensitive financial data. The threat actor behind this scheme has registered the domain recently—on February 12, 2026—using NameSilo, LLC as the registrar, which is a common choice for malicious actors seeking anonymity and low-cost domain hosting. The domain resolves to IP address 104.21.15.96 and, despite its recent creation, has already drawn minimal attention from security vendors, with only 1 out of 95 flagging it as malicious on VirusTotal. PhishDestroy identifies this domain as an active cryptocurrency exchange phishing scam, designed to lure victims into entering their login credentials or payment details under the false pretense of accessing CoinCorner’s services. The domain’s SSL certificate, issued by Google Trust Services, may lend an air of legitimacy, but the low detection rate on VirusTotal (1/95) highlights its stealthy nature and the challenge security tools face in identifying it. Additionally, the domain’s recent registration date and the choice of registrar further underscore its malicious intent, as threat actors often exploit newly registered domains to evade detection before security mechanisms can adapt. Users who have visited coincorner.trade should immediately cease any interaction with the site and assess whether they entered any credentials or payment information. If credentials were provided, users must change their passwords immediately and enable multi-factor authentication on their legitimate CoinCorner accounts. For those who entered financial details, contacting their bank or payment provider to report potential fraud and request a card replacement is critical. Organizations are advised to block the domain at the network level and monitor for any related suspicious activity. Report any interactions with this domain to your IT security team or the appropriate cybercrime unit to aid in broader threat mitigation efforts.