coinverification[.]org

Analysis indicates that coinverification.org was registered on April 27 2025 through Atak Domain Bilgi Teknolojileri A._. The authoritative name servers ns1.host-forest.com and ns2.host-forest.com resolve the domain to the IPv4 address 198.12.66.123, which belongs to AS36352 (HostPapa) and is geolocated in the United States. The site was served over HTTPS with a Let’s Encrypt R13 certificate, but the HTTP status is currently offline, suggesting the content has been taken down or is otherwise inaccessible. The only retrieved page title reads “Index of /node_modules/@particle‑network/”, a directory listing that is commonly associated with malicious actors exposing library paths used in phishing kits.

The domain has a Gridinsoft trust score of 0 / 100, indicating a history of malicious activity. It appears on two independent security blocklists and has been explicitly blocked by PhishDestroy and ScamSniffer. VirusTotal analysis shows that five of ninety‑five scanning engines have flagged the domain, reinforcing the suspicion of malicious use. Despite the limited visible content, the combination of a low trust score, blocklist presence, directory‑listing title, and multiple vendor detections provides concrete evidence that the domain is being leveraged for generic phishing operations.

The exact phishing kit, target brand, or victim payload has not been captured, so the full scope of the campaign remains uncertain. Defenders should add coinverification.org to web‑filtering and DNS‑sinkhole rules, monitor outbound connections to the hosting IP 198.12.66.123, and continue to track any future re‑hosting attempts. Incident response teams should also flag any email or messenger communications that reference “coinverification.org” as a potential lure, and enforce multi‑factor authentication for accounts that may be targeted.