samecoin[.]xyz

The domain samecoin.xyz was registered on February 21, 2026 through Name.com, Inc. and is currently served with a Let’s Encrypt certificate (R13). The site returns an HTTP 307 redirect and enforces HSTS, indicating a deliberate attempt to maintain a persistent TLS session. The page title observed is "thesamecoin," which aligns with the generic phishing classification supplied.

Infrastructure analysis shows the domain resolves to IP address 216.198.79.1, hosted within the United States under ASN 16509, operated by Amazon.com, Inc. Nameservers ns1.vercel-dns.com and ns2.vercel-dns.com point to a Vercel deployment, confirming that the attacker is leveraging a cloud platform for rapid content delivery and potential obfuscation.

Threat intelligence signals reinforce the malicious profile: the domain appears on one security blocklist and is listed in an AlienVault OTX pulse, indicating prior detection by at least one community feed. VirusTotal scans have flagged the domain by 8 out of 95 security vendors, and PhishDestroy has actively blocked it. Gridinsoft assigns a trust score of 0 out of 100, further evidencing its reputation as hostile.

Given the active status, high risk rating, and the convergence of multiple independent detections, defensive teams should add samecoin.xyz to deny‑list configurations for DNS filtering and web proxy solutions. Continuous monitoring of the associated IP range (216.198.79.1) and the Vercel hosting environment is advisable, as the attacker may shift payloads or replicate the phishing infrastructure on adjacent assets. Incident response teams should also consider sinkholing any traffic directed to the domain to disrupt credential harvesting attempts and gather additional telemetry for attribution.