poo-coin2[.]cc

This domain, poo-coin2.cc, operates as a cryptocurrency wallet drainer, a type of phishing attack designed to deceive users into connecting their digital wallets to malicious smart contracts. Once connected, these contracts execute unauthorized transactions, siphoning funds directly from the victim’s wallet without consent. The domain mimics legitimate cryptocurrency platforms, leveraging social engineering tactics such as fake token airdrops, investment opportunities, or wallet recovery prompts to trick users into engaging with the malicious interface. Analysis of the domain’s infrastructure and behavioral patterns confirms its primary function as a crypto drainer, targeting users of decentralized finance (DeFi) and blockchain-based applications.

Technical evidence supports the classification of poo-coin2.cc as a high-risk phishing domain. The domain was registered on April 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive registrations. It is flagged by 7 out of 95 security vendors on VirusTotal, indicating detection by multiple threat intelligence sources. Additionally, the domain appears on three independent security blocklists and resolves to the IP address 104.21.39.199, which is proxied through Cloudflare’s network, a common tactic to obscure the true hosting infrastructure. The page title, www.www.poo-coin2.cc, further suggests poor operational security, as it includes redundant subdomains likely generated by an automated phishing kit. These indicators collectively demonstrate a deliberate effort to deploy and maintain malicious infrastructure while evading detection.

Users who visited poo-coin2.cc or interacted with its content should take immediate action to mitigate potential financial loss. If a cryptocurrency wallet was connected to the site, revoke all active smart contract approvals using a blockchain explorer or a dedicated revocation tool. Monitor wallet activity for unauthorized transactions and transfer remaining assets to a new, secure wallet. Scan all devices used to access the domain for malware, as phishing sites may deploy additional payloads. Report the incident to relevant blockchain security teams and consider filing a report with local cybercrime authorities. To prevent future exposure, verify domain authenticity through official sources before interacting with any cryptocurrency-related website, and enable multi-factor authentication on all digital asset accounts.