coin-checker[.]xyz

The domain coin-checker.xyz is classified as a high‑risk generic phishing site that delivers a crypto‑drainer campaign. It was registered on May 20, 2026 through GMO Internet Group, Inc. d/b/a Onamae.com and resolves to the IP address 13.248.169.48, which is hosted in Canada via an AWS Global Accelerator endpoint. The domain uses the GoDaddy.com TLS Intermediate CA DV – R1v1 certificate for HTTPS connections, and an HTTP request returns a 200 status code. Infrastructure analysis shows the domain is served by the nameservers ns5.afternic.com and ns6.afternic.com, with an additional verification nameserver fragment present. Reputation data indicate that five of ninety‑one VirusTotal scanners have flagged the domain, it appears on three public blocklists, and it is referenced in one AlienVault OTX pulse. The site has been blocked by multiple phishing‑mitigation services, including PhishDestroy, MetaMask, and SEAL, and receives a Gridinsoft trust score of 0 out of 100. Content‑level examination has not been provided, so the exact phishing page layout and targeted assets remain unknown. Defenders should prioritize blocking coin-checker.xyz at the DNS and proxy layers, incorporate its IP and nameserver details into network‑based threat feeds, and monitor for any outbound connections to the associated AWS accelerator endpoint. Continuous re‑evaluation is advised in case the site’s content or hosting changes.