coin-code[.]xyz

The domain coin-code.xyz is currently active and classified as a high‑risk credential phishing site. DNS resolution points to the address 13.248.169.48, which is hosted within an AWS Global Accelerator node located in Canada. Authoritative nameservers are ns5.afternic.com, ns6.afternic.com, and verification-gakbzzzqmt6gkcplw4efpp.ns, indicating use of a third‑party registration service. The domain was created on 20 May 2026 through GMO Internet Group, Inc. d/b/a Onamae.com and is protected by a GoDaddy Secure Certificate Authority ‑ G2 TLS certificate. Infrastructure analysis shows the domain appears on three security blocklists and has a Gridinsoft trust score of 0 / 100, reflecting extreme distrust. VirusTotal records indicate that 9 of 91 scanned security engines flagged the domain, reinforcing the malicious assessment. AlienVault OTX lists the domain in a single threat pulse, providing additional external corroboration. The site delivers credential phishing, but no publicly available page content or target brand information has been captured, leaving the exact phishing vector uncertain. Defenders should immediately block coin-code.xyz at DNS and proxy layers, add the associated IP address to threat‑intel feeds, and monitor for any related traffic to the AWS Global Accelerator endpoint. Ongoing observation of the nameserver configuration and any future changes to the TLS certificate is advised, as such modifications often precede campaign escalation.