coinstrpt[.]click

This domain, coinstrpt.click, is identified as a phishing infrastructure specifically designed to impersonate cryptocurrency wallet platforms for credential harvesting. Analysis indicates the domain is currently offline, though prior activity suggests it targeted users seeking wallet access or recovery services. The threat type aligns with generic phishing but exhibits characteristics of targeted financial fraud, likely aiming to capture login credentials, private keys, or recovery phrases. Infrastructure analysis reveals the domain was registered through NAMECHEAP INC on June 12, 2026, an unusual future date that may indicate domain spoofing or registry manipulation. It resolves to the IP address 188.114.96.3 and employs Cloudflare services, including HTTP/3, to obfuscate its origin. The domain holds a Gridinsoft trust score of 0 out of 100 and is flagged by 4 of 95 security vendors on VirusTotal. It appears in four AlienVault OTX threat intelligence pulses and is listed on one security blocklist. The SSL certificate is issued by Google Trust Services, a common tactic to lend false legitimacy to malicious sites. The page title, 'coinstrpt.click | 523: Origin is unreachable,' suggests recent takedown efforts or backend failures. Current status confirms the domain is offline, though its infrastructure remains a residual risk. Organizations and individuals are advised to block the domain and its associated IP (188.114.96.3) at the network level. Security teams should monitor for related domains registered through the same registrar or resolving to identical infrastructure. Users who may have interacted with the domain should immediately revoke any exposed credentials, enable multi-factor authentication on cryptocurrency wallets, and scan systems for malware. Given the domain's use of Cloudflare and Google Trust Services, defenders should prioritize detection of similar patterns in future phishing campaigns.