coincheckplus[.]com

Analysis indicates that coincheckplus.com was registered through NameSilo on 4 September 2025 and is currently taken offline. The domain resolves to IP 104.21.36.150, which belongs to Cloudflare, Inc. (AS13335) in the United States. Both authoritative name servers – ignat.ns.cloudflare.com and zara.ns.cloudflare.com – are Cloudflare‑managed, suggesting the attacker leveraged Cloudflare’s CDN and DNS services to hide the true hosting location. No SSL/TLS certificate is presented for the domain, meaning any HTTPS connection would be rejected or fallback to HTTP, a characteristic often observed in quickly deployed malicious sites.

Reputation services show a uniformly negative profile. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on at least one public security blocklist. VirusTotal reports that three of ninety‑five scanning engines flagged the domain for malicious behavior, reinforcing the suspicion. The domain is also listed in a single AlienVault OTX pulse, providing additional community‑based corroboration. PhishDestroy has explicitly blocked the domain, and the site is identified as impersonating the cryptocurrency exchange MEXC, indicating a brand‑impersonation motive.

The available evidence does not include a page title, HTTP response details, or concrete payload samples, leaving the exact phishing vector unknown. Defenders should therefore treat any traffic to coincheckplus.com as malicious, enforce blocking at network perimeter, and add the domain to internal indicator‑of‑compromise (IOC) lists. Monitoring for other domains registered through the same registrar or using the same Cloudflare name servers may reveal related campaigns. Continuous observation of the associated IP address for new hostings is also advised, as the infrastructure could be repurposed after the current takedown.