ezcoinsol[.]com

Analysis of ezcoinsol.com shows a short-lived domain that was actively serving a crypto‑related fraud page before being taken offline. The site presented the page title "EZ COIN," consistent with the reported scam type of a crypto scam. Registration data indicates the domain was created on August 29, 2025 through Name.com, Inc., and it resolves to the IP address 35.157.26.135, which belongs to the Amazon.com, Inc. network (AS16509) and is geolocated in Germany. The hosting environment is identified as Netlify, and the site enforced HTTP Strict Transport Security (HSTS).

TLS was provided by a Let’s Encrypt certificate (E8). An HTTP request to the domain returned a 200 status code, confirming that the site was reachable and delivering content prior to its offline status. The domain earned a Gridinsoft trust score of 0 out of 100, reflecting a high confidence of malicious intent. Security monitoring services have flagged the domain; it appears on one security blocklist and is listed as blocked by PhishDestroy.

VirusTotal analysis recorded a single detection out of 95 scanned vendors, further corroborating the malicious classification. Defenders should immediately block both the domain name and its resolved IP address, monitor the associated Netlify and AWS infrastructure for similar patterns, and incorporate the observed indicators—such as the Let’s Encrypt certificate fingerprint, HSTS enforcement, and the specific nameserver set (dns1‑dns4.p08.nsone.net)—into threat‑intel feeds. Continuous observation of newly registered domains using the same registrar or hosting profile is recommended to pre‑empt replication of this crypto‑scam infrastructure.