aicoim[.]ai

Analysis of the domain aicoim.ai indicates it is operating as a high-risk phishing site targeting Web3 and cryptocurrency users. The domain was registered on November 4, 2025, through Dynadot Inc and currently resolves to the IP address 188.114.97.3, hosted by Cloudflare in Canada. The site returns an HTTP 200 status, signaling an active web presence, and uses Cloudflare nameservers (aisha.ns.cloudflare.com and kip.ns.cloudflare.com), which is consistent with many phishing campaigns leveraging Cloudflare’s infrastructure for anonymity and resilience. The page title, 'AiCoin 全球领先的 Web3 行情与数据分析工具-AiCoin官网,' explicitly positions the site as a Web3 market and data analysis tool under the 'AiCoin' brand. While the exact content and functionality of the site remain unconfirmed, the combination of a cryptocurrency-related brand name and the use of Cloudflare’s services aligns with known phishing tactics in the Web3 space.

The domain is flagged by one security blocklist, and three out of 91 security vendors on VirusTotal have detected it as malicious, further supporting the assessment of high risk. The SSL certificate is issued by Google Trust Services (WE1), which is not inherently suspicious but does not mitigate the domain’s association with phishing activity. Technologies detected on the site include HSTS, Google Analytics, Cloudflare Browser Insights, and HTTP/3, which are commonly used by both legitimate and malicious sites to enhance performance and tracking capabilities. The domain is currently blocked by PhishDestroy, a phishing-specific detection service, reinforcing the classification of this infrastructure as part of a phishing campaign.

Defenders should treat aicoim.ai as an active threat. Network-level blocking is recommended, particularly for organizations with exposure to cryptocurrency or Web3-related services.