coinxhive[.]com

The domain coinxhive.com is currently active and has been assigned a high risk rating. Automated analysis categorizes the site as a generic phishing operation. The page title returned by the server is "Coinxhive - Investment company", indicating an attempt to pose as an investment entity. The site responded with HTTP status code 200, confirming that the payload is reachable.

Infrastructure inspection shows that coinxhive.com resolves to the IPv4 address 185.254.197.204, which belongs to AS30860 (Virtual Systems LLC) and is geolocated in Ukraine. The authoritative name servers are ns21.v-sys.org and ns22.v-sys.org. The TLS certificate is issued by Let’s Encrypt (R13), providing a valid HTTPS endpoint. Service banners reveal an Nginx front‑end delivering a site built with Bootstrap, jQuery and the Smartsupp live‑chat widget.

Reputation data indicates a Gridinsoft trust score of 0 out of 100 and presence on three security blocklists. The domain is already blocked by PhishDestroy, MetaMask and SEAL. A VirusTotal scan reported that 2 of 95 security vendors flagged the domain, reinforcing the malicious classification. The registrar listed is GMO Internet, Inc., and the domain was created on 26 May 2025.

Analysis confirms that the domain is actively serving a phishing page, but the exact content of the page has not been captured in this report. Defenders should continue to block coinxhive.com at network perimeters, update intrusion detection signatures, and monitor for any associated command‑and‑control traffic. Because the hosting infrastructure is shared, additional domains hosted on the same IP or name servers should be inspected for similar behavior.