quidcoin[.]xyz

Analysis of the domain quidcoin.xyz indicates it is an active crypto drainer phishing site targeting users of The Open Network (TON) jettons. The domain was registered on February 21, 2026, through NameCheap, Inc., and currently resolves to IP address 192.250.239.61, hosted on AS51713 (WHG Hosting Services Ltd) in the United Kingdom. The site returns an HTTP 200 status, confirming its operational status as of July 12, 2026. Infrastructure analysis reveals the use of WordPress, MySQL, PHP, and LiteSpeed, alongside frontend libraries jQuery and jQuery Migrate. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites. The page title, 'Liquidity for TON jettons,' directly references TON-based cryptocurrency assets, suggesting an intent to deceive users into interacting with fraudulent liquidity or token-swapping services. Security vendor detections on VirusTotal show 6 of 93 engines flagging the domain as malicious, while the domain appears on one security blocklist. The domain's nameservers are ns1.mysecurecloudhost.com and ns2.mysecurecloudhost.com, a configuration consistent with bulletproof or low-reputation hosting providers. Gridinsoft assigns a trust score of 0/100, further indicating high-risk classification. No confirmed victim reports or transaction data are available at this time, but the combination of technical indicators—including the crypto drainer classification, TON-specific targeting, and hosting on a known high-risk ASN—supports immediate blocking. Defenders should treat this domain as hostile and prioritize its inclusion in network-level deny lists, endpoint protection rules, and email/URL filtering systems. Further monitoring of associated IP ranges and nameserver patterns is recommended to identify related threats.