coingoat[.]io

The domain coingoat.io is currently active and classified as a high‑risk generic phishing site. It was registered on March 04, 2026 through NameCheap, Inc., and resolves to the IPv4 address 50.87.253.188, which is geolocated to the United States and belongs to AS46606 Unified Layer. DNS resolution uses the Bluehost name servers ns1.bluehost.com and ns2.bluehost.com, and the domain publishes an MX record set of two entries: priority 0 pointing to mail.coingoat.io and priority 10 to coingoat (truncated in the source). The site presents an SSL certificate issued by Let’s Encrypt (R12) and returns HTTP 200 for the root URL. The page title returned is "Coin Goat", but no further content analysis is available. Detected server‑side technologies include WordPress, MySQL, PHP, Node.js, particles.js, Chart.js, Bootstrap, and Socket.io, indicating a typical web‑application stack. Threat intelligence indicates that three security vendors on VirusTotal have flagged the domain, and it appears on three public blocklists. It is already blocked by PhishDestroy, MetaMask, and SEAL, and receives a Gridinsoft trust score of 0 / 100. While the exact phishing lures and credential‑capture mechanisms remain unverified, the combination of recent registration, high‑risk rating, active hosting, and multiple detections suggests a malicious intent. Defenders should add coingoat.io to network and DNS blocklists, monitor for related traffic to 50.87.253.188, and consider sinkholing any observed connections. Continuous observation is advised to capture any future payloads or credential‑harvesting pages that may be deployed under the Coin Goat branding.