xaut-coin[.]com

The domain xaut-coin.com was registered via Cloud DNS Ltd and created on 25 February 2026. It resolves to 185.105.33.106, an address in Great Britain owned by AS43927 HOSTERION SRL and fronted by Cloudflare DNS (kehlani.ns.cloudflare.com, rob.ns.cloudflare.com). The site presented the page title “The new site has been successfully created and is ready to work” and employed a stack that includes PHP, Lodash, jQuery (both CDN and local), FancyBox, cdnjs libraries, and Cloudflare Browser Insights, indicating a generic web‑application framework rather than a bespoke phishing kit. The TLS certificate is issued by Let’s Encrypt (E7), which is typical for short‑lived malicious sites.

A Gridinsoft trust score of 0/100 and placement on three security blocklists, together with explicit blocks by PhishDestroy, MetaMask, and SEAL, demonstrate that the infrastructure has been recognized as malicious. VirusTotal analysis shows that two of ninety‑five antivirus engines flagged the domain, providing additional corroboration. The domain is currently taken offline, and no live HTTP response is observable.

The only brand reference in the intelligence is an impersonation of Coinbase, but the page content has not been captured, so the exact luring technique remains unknown. Defenders should add the domain and its resolved IP to blocklists, monitor for any re‑registration or resurrection of the host, and ensure that endpoint and email security solutions are updated to reflect the blocklist entries. Continuous watch for new assets using the same registrar, hosting provider, or naming‑server pattern is advised, as threat actors often recycle similar infrastructure.