coinsageai[.]bond

This domain, www.coinsageai.bond, is flagged as an active cryptocurrency credential theft operation targeting users of the CoinSageAI platform. Analysis indicates the site employs social engineering tactics to impersonate the legitimate CoinSageAI service, presenting a fraudulent interface designed to harvest wallet credentials, private keys, and seed phrases. The infrastructure shows no direct evidence of a crypto drainer kit, but the credential theft mechanism aligns with common pre-drainer attack vectors used to gain unauthorized access to cryptocurrency wallets. The site’s design and branding closely resemble the legitimate CoinSageAI platform, increasing the likelihood of successful deception among users familiar with the service. Technical indicators confirm the domain’s malicious nature. The domain resolves to IP address 104.21.54.237, a Cloudflare-protected endpoint that obscures the true hosting infrastructure. It was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. VirusTotal detection shows 2 out of 95 security vendors have flagged the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Despite its recent creation, the domain’s infrastructure and behavioral patterns align with known credential theft campaigns targeting cryptocurrency users. As of the latest assessment, www.coinsageai.bond has been taken offline, likely in response to detection and blocking by security vendors. However, the remaining risk persists due to the potential for the threat actors to re-establish the infrastructure under a new domain or IP address. Users who may have interacted with the site are advised to immediately revoke any wallet permissions, transfer assets to a new secure wallet, and monitor for unauthorized transactions. Organizations and individuals should update blocklists to include this domain and its associated IP address to prevent future access attempts. Continuous monitoring of newly registered domains with similar naming patterns is recommended to identify potential resurgence of this campaign.