coinchecker[.]org

Analysis conducted on July 22, 2026 indicates that the domain coinchecker.org was registered through Cloudflare, Inc. on September 15, 2025 and is serviced by the authoritative nameservers vida.ns.cloudflare.com and wesley.ns.cloudflare.com. DNS resolution points to the IP address 172.67.164.151, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents an HTTPS certificate issued by Google Trust Services under the label WE1, confirming a valid TLS chain despite the malicious intent. An HTTP request returns a 403 status code, suggesting that access is deliberately denied or that the content is being blocked. The only page metadata retrieved is the title "AML Scanner," implying that the domain attempts to masquerade as a service offering anti‑money‑laundering scans, which aligns with the classified investment‑scam threat type.

The domain appears on six external security blocklists and is actively blocked by browser extensions and cryptocurrency wallets including PhishDestroy, MetaMask, Polkadot, SEAL, and Enkrypt. A VirusTotal scan recorded detections from two of ninety‑five scanning engines, reinforcing the malicious assessment. Detected technologies consist of Cloudflare services and HTTP/3, typical of fast‑response CDN‑hosted infrastructure. Uncertainties remain regarding the exact phishing kit, page content, or credential‑harvesting mechanisms because no HTML capture or visual analysis is available; the site is presently offline, limiting further probing.

Defensive guidance recommends that organizations add coinchecker.org to DNS‑based blocklists, firewall URL filters, and endpoint protection policies, ensuring that the aforementioned extensions remain enabled. Continuous monitoring of the associated Cloudflare nameservers for newly‑created subdomains is advised, as threat actors often recycle the same hosting environment.