getcoincheck[.]com

The domain getcoincheck.com was registered on August 09, 2025 through NameSilo, LLC. DNS resolution points to the IP address 188.114.96.3, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The domain uses Cloudflare’s default authoritative nameservers ignat.ns.cloudflare.com and zara.ns.cloudflare.com, indicating that the attacker leveraged a reputable DNS provider to hide infrastructure. No TLS certificate is presented for the site, and the HTTP service does not respond with HTTPS, which is consistent with the observed “offline” status at the time of analysis. Security monitoring shows the domain appears on a single public blocklist and is actively blocked by the PhishDestroy service. Independent scanning on VirusTotal recorded detections by 2 of 95 security vendors, reinforcing the suspicion of malicious use.

The Gridinsoft trust score is 0 out of 100, the lowest possible rating, which aligns with the other indicators of abuse. The domain is explicitly flagged as an impersonation of the cryptocurrency exchange MEXC, matching the “brand impersonation” threat type. Evidence suggests the infrastructure was intended for phishing or credential harvesting against MEXC users, but the site is currently offline, limiting direct observation of payload or page content. The lack of a valid SSL certificate and the minimal detection footprint leave some uncertainty about the exact delivery mechanism, such as whether a separate hosting layer or redirect chain was used.

Defenders should continue to block getcoincheck.com at network perimeter and DNS filtering layers. Threat hunters should query historical DNS and web archives for snapshots of the site prior to takedown to extract potential phishing templates, URLs, or malicious payload hashes. Monitoring for newly registered domains that resolve to the same Cloudflare IP range and share similar naming patterns is recommended, as attackers often recycle infrastructure.