infinexcoin[.]xyz

Infinexcoin.xyz was observed to resolve to the IP address 185.199.111.153, which belongs to the Fastly network (AS54113) located in the United States. The domain is hosted on GitHub Pages and served through Varnish caching, as indicated by the technology fingerprint. A TLS certificate issued by Let’s Encrypt (R12) is present, confirming that HTTPS connections are established. When accessed, the site returns an HTTP 404 status and the page title “Site not found · GitHub Pages”, suggesting that the original content has been removed or never existed.

The domain was registered on 16 November 2025 through Go Daddy, LLC, and uses the default Go Daddy name servers ns31.domaincontrol.com and ns32.domaincontrol.com. VirusTotal scans show that seven out of ninety‑five security vendors flagged the domain, and it is listed on a single public blocklist, where it has also been added to the PhishDestroy blacklist. The current operational status is reported as offline, and no additional content or phishing payloads have been captured. The available evidence confirms that the infrastructure is typical of temporary phishing deployments that leverage free hosting platforms.

However, the absence of a live page limits direct observation of the malicious payload, making the exact phishing technique uncertain. Defenders should continue to block the domain at network perimeter, monitor DNS queries for the associated IP and name servers, and ensure that any references to infinexcoin.xyz are treated as malicious in email and web filters. Ongoing threat‑intel feeds should be consulted for any future re‑activation, and incident response teams should consider the domain compromised for the duration of its activity.