coin-craddle[.]net

This domain is flagged as a cryptocurrency exchange phishing site under active investigation. Analysis indicates it impersonates CoinCraddle, a purported platform for seamless cryptocurrency trading, with the intent to harvest user credentials, private keys, or facilitate fraudulent transactions. The risk level remains classified as under_investigation due to incomplete forensic data, though the threat type is confirmed as generic_phishing targeting cryptocurrency users. Infrastructure analysis reveals the domain was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to IP address 104.21.93.205, which is associated with Cloudflare services, a common tactic to obfuscate hosting origins. The site employs Node.js and Express for backend operations, alongside HTTP/3 for optimized performance. Detection metrics show 0/95 detections on VirusTotal and a Gridinsoft trust score of 0/100, indicating no prior malicious classification but also no established legitimacy. The domain appears on one security blocklist, specifically PhishDestroy, and is currently offline, suggesting either takedown or temporary suspension. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP (104.21.93.205) at the network perimeter. Organizations should monitor for credential reuse attempts from users who may have interacted with the site before its takedown. Cryptocurrency wallet providers and exchange platforms are advised to flag transactions originating from or linked to this domain’s infrastructure. End-users should be alerted to verify exchange URLs against official sources and enable multi-factor authentication on all crypto-related accounts. Given the domain’s recent creation date and use of Cloudflare, further monitoring of newly registered domains with similar patterns is recommended.