mail[.]coinmarketcaa[.]com

This domain, mail.coinmarketcaa.com, is identified as a high-severity brand impersonation threat targeting EigenLayer, a cryptocurrency restaking protocol. Analysis indicates the domain mimics EigenLayer’s official branding, including an identical page title, to deceive users into disclosing sensitive credentials or authorizing malicious transactions. No explicit drainer kit signatures were detected, but the infrastructure aligns with known wallet-draining campaigns observed in similar phishing operations. Infrastructure analysis reveals the domain was registered on May 21, 2026, through Ultahost, Inc., and resolves to the IP address 159.100.6.19. Security vendor assessments on VirusTotal show 19 out of 95 engines flagging the domain as malicious. The domain appears on four security blocklists and is actively blocked by multiple browser-based wallet protection mechanisms. Detected technologies include LiteSpeed and HTTP/3, with a Let’s Encrypt SSL certificate, suggesting a modern, low-cost hosting setup designed to evade basic detection. As of the latest verification, mail.coinmarketcaa.com has been taken down, likely due to registrar intervention or hosting provider action. However, residual risk persists as threat actors may re-deploy the domain or migrate to newly registered lookalike domains. Users are advised to verify domain authenticity via official EigenLayer communication channels and employ wallet transaction simulation tools to inspect contract interactions before approval. Network-level blocking of the resolved IP (159.100.6.19) is recommended for organizations to prevent potential lateral movement or secondary infections.