en[.]coiresolverapp[.]live

This domain, en.coiresolverapp.live, was registered on 21 February 2026 and is currently taken offline. Infrastructure analysis shows it resolves to the Amazon‑owned address 199.59.243.228, which is announced by AS16509 in the United States. The site presented the page title “coiresolverapp.live” and employed an SSL certificate rated R10. Reputation scoring from Gridinsoft assigns a zero‑point trust rating (0/100), indicating an extremely low level of legitimacy.

The domain appears on three independent security blocklists and is actively blocked by PhishDestroy, ScamSniffer, and Enkrypt. VirusTotal scans report that 16 of 93 antivirus and URL‑reputation engines flagged the domain as malicious, reinforcing the blocklist evidence. The observed scam type is identified as a crypto‑related scam, consistent with the generic phishing classification. Because the site is offline, the exact malicious payload, phishing pages, or cryptocurrency‑draining mechanisms cannot be examined, and the specific tactics employed remain unknown.

Nonetheless, the combination of a fresh registration, Amazon hosting, low SSL rating, zero trust score, multiple blocklist listings, and multi‑vendor detections provides strong confidence that the domain was used for fraudulent activity. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurrection attempts, and consider adding the IP address 199.59.243.228 to deny‑list rules. Additional mitigation steps include updating URL filtering policies, enabling TLS inspection where feasible, and sharing indicators of compromise with industry partners to improve collective detection.