checker-cukecoin[.]xyz

Analysis indicates that checker-cukecoin.xyz is a newly registered domain created on 21 February 2026 and is presently offline. The domain resolves to 104.21.1.172, an address owned by AS13335 Cloudflare, Inc. headquartered in the United States. DNS resolution is served by drake.ns.cloudflare.com and natasha.ns.cloudflare.com, confirming Cloudflare as the authoritative DNS provider. The site presented the page title “Cuke Coin”, suggesting an attempt to mimic a cryptocurrency project or token named Cuke Coin.

The TLS certificate is issued by Google Trust Services under the WE1 series, providing a valid HTTPS endpoint that may have been used to lend legitimacy to the phishing page. Infrastructure analysis shows the site leveraged Cloudflare’s HTTP/3 support, indicating the use of modern web protocols to possibly evade detection. The registrar listed as NiceNIC International Group Co., Limited, a known bulk‑registration service, aligns with patterns observed in other phishing infrastructure. The domain appears on four dedicated security blocklists and has been flagged by multiple anti‑phishing services, including PhishDestroy, MetaMask, ScamSniffer, and SEAL.

VirusTotal scans reported five detections out of ninety‑three scanners, reinforcing the malicious assessment despite the current offline state. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurrection of the host, and incorporate the observed indicators—IP address 104.21.1.172, the two Cloudflare nameservers, and the Google‑issued TLS certificate fingerprint—into threat‑intel feeds. Because the site is no longer reachable, static analysis of the content is limited; further investigation may be required if the domain reappears or if related domains share the same registration or hosting patterns.