coincheck69[.]org

Analysis of the domain coincheck69.org indicates it was actively impersonating the Coincheck cryptocurrency exchange platform, as evidenced by the page title 'coincheck' and the domain's naming convention. Registered on August 28, 2025, through Gname.com Pte. Ltd., the domain resolved to the IP address 182.16.54.146, hosted under AS45753 (Netsec Limited) in Hong Kong. The domain's nameservers, a2.share-dns.com and b2.share-dns.net, are consistent with infrastructure observed in other phishing campaigns, though no specific phishing kit or additional brand impersonation details are confirmed in the available data. The domain was flagged by 10 of 95 security vendors on VirusTotal, and it appears on at least one security blocklist, corroborating its classification as malicious.

Scamadviser assigned a trust score of 1 out of 100, further supporting the elevated risk assessment. The SSL certificate, issued to 'CoinCheck69 / coincheck69.org,' suggests an attempt to appear legitimate, though the certificate's details do not align with the official Coincheck exchange's infrastructure. As of the report date, the domain has been taken offline and is blocked by PhishDestroy, though defenders should remain vigilant for potential reemergence under similar naming schemes or infrastructure.

The exact content and functionality of the site remain unanalyzed, but the combination of domain registration details, hosting provider, SSL certificate, and detection by multiple security vendors strongly indicates a phishing operation targeting users of the Coincheck platform. Defenders are advised to monitor for related domains using variations of 'coincheck' or similar naming patterns, particularly those registered through the same registrar or resolving to the same IP range. Network-level blocking of the IP 182.16.54.146 and associated AS45753 infrastructure may mitigate residual risk from this campaign.