coinspheremarkets[.]xyz

Analysis of coinspheremarkets.xyz shows a short-lived infrastructure that was actively used for phishing before being taken offline. The domain was registered on February 21, 2026 and resolves to the Amazon‑hosted IP address 199.59.243.228, which belongs to ASN 16509 (Amazon.com, Inc.) and is located in the United States. The site presented the page title "coinspheremarkets.xyz," offering no additional context about the targeted brand or service. An SSL certificate classified as R12 was observed, indicating a low‑trust certificate that does not meet modern validation standards.

The Gridinsoft trust score of 49 out of 100 further reflects a borderline reputation, and the domain appears on a single security blocklist. PhishDestroy has already blocked the site, and VirusTotal records show four of ninety‑three scanning engines flagging the domain as malicious, confirming its phishing nature despite the limited detection count. The current HTTP status is offline, which prevents real‑time verification of payloads or page content, leaving the exact phishing technique (login capture, credential harvesting, etc.) unknown. Defenders should proactively add coinspheremarkets.xyz to URL filtering policies across web gateways and DNS security solutions, enforce blocking of its resolving IP 199.59.243.228, and monitor for any resurgence of the domain on newly observed hosting allocations.

Given the Amazon infrastructure, threat actors may relocate to adjacent IP ranges; thus, extending blocklist coverage to the /24 subnet (199.59.243.0/24) is advisable. Continuous telemetry from endpoint detection and response (EDR) tools should be tuned to alert on any process that attempts connections to this domain or IP, even if the site is currently offline. While the limited blocklist presence and modest trust score suggest a low‑profile campaign, the confirmed phishing flag and vendor detections warrant an elevated risk posture until the infrastructure is fully retired.