coirnsbee[.]com

This domain, coirnsbee.com, is identified as a high-risk cryptocurrency phishing operation designed to deceive users into disclosing wallet credentials or authorizing fraudulent transactions. Analysis indicates the site employs a wallet drainer kit, likely targeting users of decentralized finance (DeFi) platforms or cryptocurrency wallets. The infrastructure mimics legitimate wallet interfaces, tricking victims into entering private keys or seed phrases, which are then exfiltrated to attacker-controlled servers. No direct brand impersonation is evident, but the generic design suggests broad targeting across multiple wallet providers. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 104.21.60.25, a Cloudflare proxy endpoint commonly used to obfuscate hosting origins. It was registered on April 09, 2026, through Internet Domain Service BS Corp, a registrar frequently associated with malicious domains. VirusTotal detection metrics show 16 out of 95 security vendors flagging the domain as malicious, while it appears on three independent security blocklists. Google Safe Browsing (GSB) status is not explicitly provided, but the domain is actively blocked by multiple cryptocurrency-specific security tools, indicating a confirmed phishing classification. Current status remains active, with no evidence of takedown or mitigation at the infrastructure level. Response actions by security vendors include blocking the domain across browser extensions, wallet security plugins, and enterprise threat feeds. Despite these measures, the domain continues to pose a significant risk due to its recent registration, proxy-hosted infrastructure, and active phishing campaigns. Users are advised to avoid interaction with the domain entirely, verify wallet addresses independently, and employ hardware-based authentication for cryptocurrency transactions. Organizations should update blocklists to include this domain and monitor for related indicators of compromise.