coins[.]smartcrypto[.]sbs

The domain coins.smartcrypto.sbs was registered on August 28, 2025 through Web Commerce Communications Limited and is currently taken offline. Technical inspection shows the domain resolves to the IPv4 address 94.141.122.141, which is hosted in Finland under ASN 205775 (NEON CORE NETWORK LLC). No TLS certificate is present, meaning all HTTP connections would be unencrypted. The authoritative nameservers are annalise.ns.cloudflare.com and chris.ns.cloudflare.com, both operated by Cloudflare, indicating the attacker leveraged a reputable DNS provider to improve availability and evade simple hosting‑based blocking.

VirusTotal has recorded three detections out of ninety‑five scanning engines, confirming that at least a minority of security products flag the domain as malicious. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one external security blocklist, reinforcing the suspicion of malicious use. PhishDestroy has already added the domain to its block list, and the page title served when the site was reachable reads "Trojan – The Ultimate On‑Chain Trading Experience," which aligns with the declared scam type of wallet/seed phishing and the brand impersonation of Solana.

Observed indicators suggest the site was used to lure victims into providing cryptocurrency wallet seeds or private keys under the pretense of a Solana‑related trading service. The lack of SSL, low trust score, and presence on multiple blocklists indicate a low‑quality, short‑lived infrastructure typical of opportunistic credential‑stealing operations. However, the exact page content, payload delivery mechanisms, and any post‑exploitation activity remain unknown because the site is offline and no further forensic artefacts have been disclosed.

Defenders should continue to block the IP address 94.141.122.141 and the domain coins.smartcrypto.sbs at DNS and proxy layers. Security teams should monitor for related indicators such as the Cloudflare nameservers annalise.ns.