coinstrike[.]cash

Analysis of coinstrike.cash shows an active infrastructure used for brand impersonation of Binance. The domain resolves to IP 188.114.96.3, hosted behind Cloudflare (AS13335) in the United States. Service fingerprints indicate an Ubuntu operating system running Nginx, and the site presents a valid Let's Encrypt certificate (E8). The HTTP response returns status 200 and the page title is "CoinStrike - Secure Your Crypto," confirming a crypto‑focused narrative. Google Safe Browsing classifies the host under SOCIAL_ENGINEERING, and three external blocklists have already listed the domain. Additional defenses have taken action: PhishDestroy, MetaMask, and SEAL block the domain, and VirusTotal records 12 of 95 security vendors flagging it as malicious. Registration details show the domain was provisioned through Cloudflare’s registrar service, with nameservers bowen.ns.cloudflare.com and deborah.ns.cloudflare.com. No further content analysis is available beyond the title; therefore, the exact phishing mechanics (e.g., credential collection forms) remain unverified. Defenders should add coinstrike.cash to URL filtering and DNS blocklists, monitor traffic to the associated IP address, and consider tightening email gateway rules for messages referencing Binance‑related subjects. Continuous telemetry from threat intel feeds is recommended to capture any evolution of the payload or landing pages.