coinmastersfx[.]xyz

coinmastersfx.xyz was registered on March 06, 2026 through TuringSign Inc. d/b/a Cosmotown. The domain is currently pointed at the IPv4 address 163.61.188.7 and uses four authoritative name servers (dns1.lytehosting.com through dns4.lytehosting.com). Within weeks of registration the domain appeared on a security blocklist and was subsequently added to the PhishDestroy blocklist, indicating that it is being used for phishing.

VirusTotal scans show that two out of ninety‑one anti‑malware engines have flagged the domain as malicious, providing additional independent confirmation of its hostile intent. The limited detection footprint suggests that the site may be newly deployed or employing techniques to evade broader detection. No public information is available regarding SSL certificate attributes, HTTP response codes, or page content; the page title and any associated evidence links have not been disclosed in the current intelligence set.

The presence on a blocklist, the recent creation date, and the association with a known phishing takedown service collectively raise the risk rating to high. Defenders should block traffic to 163.61.188.7 and to coinmastersfx.xyz at the network perimeter, add the domain and its IP to internal blocklists, and monitor DNS queries for any future resolution changes. Additional investigation, such as retrieving the live page, examining certificate details, and correlating user‑reported incidents, is recommended to confirm the full scope of the campaign and to refine detection rules.