coineth[.]vip

The domain coineth.vip is currently classified as a high‑risk generic phishing site targeting cryptocurrency users. Analysis shows the site is actively serving content (HTTP 200) with the page title “defi‑ETH”. Google Safe Browsing labels the domain with the SOCIAL_ENGINEERING category, and ten of ninety‑five VirusTotal scanners have raised detections. Independent blocklists including PhishDestroy, MetaMask and SEAL have already added the domain to their deny lists, and Gridinsoft assigns it a trust score of 0 / 100. The front‑end stack is built with Vue.js and Marked, loads assets from jsDelivr, and communicates via Axios over HTTP/3, all delivered through Cloudflare’s edge network. The registration record indicates the domain was created on 21 February 2026 through Gname.com Pte. Ltd., and the authoritative nameservers are adam.ns.cloudflare.com and chan.ns.cloudflare.com. DNS resolution points to IP 188.114.96.3, an address owned by CloudFlare, Inc., and geolocated to Canada. The infrastructure relies on Cloudflare’s services, including HTTP/3 support, which can obscure the true origin of any backend server. No additional hosting or CDN providers are observed beyond Cloudflare. While the technical footprint confirms a phishing‑related operation, the exact payload, credential‑capture mechanisms, and any monetary collection endpoints have not been publicly disclosed. Consequently, defenders cannot yet confirm whether the site harvests private keys, redirects wallet transactions, or employs other crypto‑draining techniques. Organizations should block coineth.vip at the network perimeter, update email and web filters to include the domain and its associated IP address, and monitor for any outbound connections to the Cloudflare edge node 188.114.96.3. Users should be warned not to click links referencing “defi‑ETH” or to enter wallet credentials on this domain, and any suspicious activity should be reported to incident response teams.