coinhakox[.]org

This domain, coinhakox.org, is actively flagged as high-risk phishing infrastructure targeting cryptocurrency users. Registered on March 4, 2026, through Dynadot LLC, it resolves to IP address 188.114.97.3 and is currently operational. Analysis indicates the site presents itself under the page title 'Portfolio | Web Developer,' though the exact nature of the phishing content remains unconfirmed due to lack of direct inspection. The domain is detected by 17 of 95 security vendors and appears in 24 threat intelligence pulses, suggesting widespread recognition as malicious. It is blocked by five security blocklists, including SEAL, MetaMask, and PhishDestroy, and is explicitly flagged for social engineering by Google Safe Browsing. Infrastructure analysis reveals the use of Cloudflare for hosting and protection, alongside technologies such as Vue.js, HSTS, and HTTP/3, which may be leveraged to enhance credibility or evade detection. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites. Defenders should treat this domain as active phishing infrastructure, particularly in environments where cryptocurrency-related activity is present. Blocking at the DNS or network level is recommended, and any associated credentials or wallet interactions should be considered compromised. Further investigation into the hosting provider and certificate transparency logs may yield additional indicators of compromise.