coirdex[.]net

PhishDestroy identifies coirdex.net as an active domain involved in a generic phishing campaign aimed at deceiving users into believing they have encountered a technical issue requiring immediate support. The threat actor behind this domain leverages urgency and fear tactics to coerce victims into contacting fraudulent call centers or submitting sensitive information, which could lead to financial loss or credential theft.

This domain was flagged after analysis revealed it is linked to a known phishing infrastructure. VirusTotal currently reports zero detections out of 95 scanners, indicating its relative novelty and the challenge of detection by automated tools. The domain resolves to IP address 172.67.149.149 and operates under a Let’s Encrypt SSL certificate, which may lend it an air of legitimacy to unsuspecting users. Registered through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain was created on March 27, 2026, making it a very recent addition to the threat landscape. Despite its lack of current blocklist presence, the combination of its fresh registration, undetected status, and active resolution suggests a growing risk.

If you or your organization have encountered coirdex.net, whether through email links, browser redirects, or direct visits, it is critical to take immediate action. Users should avoid interacting with the site to prevent potential exposure to social engineering tactics or malware downloads. Organizations are advised to block the domain and IP address at the network perimeter and update email filtering rules to quarantine any messages containing references to coirdex.net. Additionally, users who have already engaged with the domain should monitor their financial accounts and credentials for signs of compromise, and consider resetting passwords for any accounts that may have been exposed. Endpoint detection and response (EDR) solutions should be updated to include behavioral indicators associated with this domain for proactive threat hunting.