cope-coins[.]com

This domain, cope-coins.com, operates as a crypto drainer phishing site designed to deceive users into connecting wallets under the pretense of accessing $COPE token services. Analysis of the page title, "Welcome to $COPE," indicates a targeted campaign aimed at cryptocurrency holders, likely exploiting interest in the $COPE memecoin or similar assets. The site employs social engineering tactics to trick victims into authorizing malicious smart contracts, enabling unauthorized transactions and fund drainage from connected wallets. The threat is particularly acute for users of decentralized finance (DeFi) platforms or those engaging in token swaps, as the domain mimics legitimate crypto project landing pages to lower suspicion. Technical evidence confirms the malicious nature of this domain. cope-coins.com is flagged by 1 out of 95 security vendors on VirusTotal, a low but notable detection rate that suggests either evasion techniques or recent deployment. The domain was registered on August 29, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains due to its lenient registration policies. Infrastructure analysis reveals the domain resolves to the IP address 172.67.153.167, a Cloudflare proxy endpoint commonly used to obscure hosting origins. Additionally, the domain appears on 2 security blocklists and is actively blocked by multiple threat intelligence feeds, reinforcing its classification as a confirmed phishing asset. Users who visited cope-coins.com or interacted with its content should take immediate remedial actions. First, revoke any wallet authorizations granted to the domain or associated smart contracts using a blockchain explorer or wallet management tool. Monitor connected wallets for unauthorized transactions and transfer remaining assets to a new, secure wallet if compromise is suspected. Scan local devices for malware, as phishing sites may deploy additional payloads. Report the domain to relevant threat intelligence platforms to aid in broader mitigation efforts. Given the domain's current offline status, vigilance is still required, as threat actors may redeploy the infrastructure under a new domain or IP address.