toucan-delegator[.]cabana[.]fi

This domain, toucan-delegator.cabana.fi, presents a targeted credential theft threat specifically designed to impersonate PoolTogether’s delegation interface. Analysis indicates the site was engineered to harvest cryptocurrency wallet credentials and private keys under the guise of a legitimate delegation portal. The fraudulent page mimics PoolTogether’s branding, including an identical page title, 'Delegate - PoolTogether,' to deceive users into entering sensitive authentication details, which would then be exfiltrated to attacker-controlled infrastructure. Infrastructure analysis reveals the domain was registered through Gandi SAS on March 27, 2026, an anomalous future date suggesting potential domain spoofing or registry manipulation. The domain resolved to the IP address 76.76.21.123 and was flagged by 6 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. Additionally, the domain appeared on one security blocklist prior to being taken offline, further corroborating its malicious intent. The Gridinsoft trust score of 0/100 underscores the domain’s complete lack of legitimacy. Users who visited toucan-delegator.cabana.fi should immediately revoke any active sessions or delegations associated with the fraudulent site. All credentials, private keys, or recovery phrases entered on the page must be considered compromised and should be rotated across all platforms where they were reused. Monitor connected wallets for unauthorized transactions and review recent delegation activities for anomalies. If financial loss occurred, report the incident to relevant blockchain analytics platforms and local cybercrime authorities with the domain, IP address 76.76.21.123, and seed identifier c0e610 for further investigation.