justamemecoinz[.]xyz

justamemecoinz.xyz was observed to host a page titled “Memecoin”. The domain was registered on July 26, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IPv6 address 2606:4700:3032::6815:2e2b, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The site is currently taken offline, but historical data show it was flagged by multiple security services. It appears on two public blocklists and received a Gridinsoft trust score of 0 out of 100, indicating a high confidence of malicious intent.

The SSL certificate associated with the domain is identified as “WE1”, and the certificate chain terminates at Cloudflare’s public PKI. VirusTotal scans recorded four positive detections out of ninety‑three submitted analyses, corroborating the blocklist findings. The domain is listed by PhishDestroy and ScamSniffer as a confirmed malicious host. The content and metadata explicitly reference a crypto‑related scam and claim to impersonate the brand “phantom”.

No additional content, such as login forms or credential harvesting pages, has been captured, so the exact delivery mechanism remains unknown. Defenders should continue to block the domain at perimeter and DNS filtering layers, and monitor for any resurgence of the IPv6 address or related Cloudflare‑hosted assets. Threat hunters may also query Cloudflare logs for other domains sharing the same address block, as the infrastructure suggests a shared hosting environment that could be leveraged for further malicious campaigns. Because the site is offline, active takedown is not possible, but continued observation is recommended to detect potential re‑hosting or re‑use of the same registration details.