coinvace[.]online

The domain coinvace.online has been identified as a confirmed brand impersonation phishing site targeting users of the Across cryptocurrency platform. Analysis indicates the domain was specifically designed to deceive visitors by masquerading as a legitimate forex trading platform associated with Across, a well-known blockchain bridging service. The page title, 'Coinvace Platform- Forex trading with a reliable broker,' further reinforces this deception by presenting itself as a trustworthy financial service provider. Current status confirms the domain is offline, though prior activity suggests it was actively used for malicious purposes. Infrastructure analysis reveals critical technical indicators of compromise. The domain resolves to the IP address 161.97.121.66, hosted on AS51167 (Contabo GmbH) in France, a provider frequently associated with high-risk activities. Registered through Cosmotown Inc on February 21, 2026, the domain lacks an SSL certificate, a red flag for any financial or cryptocurrency-related service. Security vendors have flagged the domain extensively, with 14 out of 95 VirusTotal engines detecting malicious activity. Additionally, the domain appears on three security blocklists and is explicitly blocked by multiple threat intelligence platforms, including PhishDestroy, MetaMask, and SEAL. Google Safe Browsing has also classified the domain as phishing, further corroborating its fraudulent nature. Given the high-risk classification and confirmed brand impersonation, immediate action is recommended for organizations and individuals. Network administrators should ensure the domain and its associated IP (161.97.121.66) are blocked at the firewall and DNS levels to prevent accidental access. Users who may have interacted with the domain should monitor their accounts for unauthorized transactions, particularly those involving cryptocurrency or financial platforms. Security teams are advised to review logs for any connections to the domain or its IP address and conduct a thorough investigation if any interactions are detected. Proactive measures, such as educating users on recognizing phishing attempts and verifying domain authenticity, are critical to mitigating similar threats in the future.