coinvoya[.]com

Analysis of coinvoya.com shows a newly registered domain that is actively used for generic phishing. The domain was created on May 30, 2026 and is hosted on Cloudflare infrastructure, as indicated by its authoritative nameservers becky.ns.cloudflare.com and brad.ns.cloudflare.com. DNS resolution points to the IP address 172.67.197.128, which is part of Cloudflare’s edge network.

Registration was performed through Hostinger Operations, UAB, a known bulk‑registration service. The domain appears on a single security blocklist and is explicitly listed by PhishDestroy as a blocked phishing source. VirusTotal reports that the domain has been scanned by 91 antivirus and URL‑reputation engines, with no detections recorded; this lack of flags does not confirm legitimacy and should be treated as inconclusive.

No public Safe Browsing, OTX, or SSL/TLS details are available, and the page title or content has not been captured, leaving the exact lure and credential‑stealing mechanisms unverified. Given the confirmed phishing classification, defenders should proactively block coinvoya.com at DNS and proxy layers, monitor traffic to the associated Cloudflare IP for anomalous patterns, and consider adding the domain to internal threat intel feeds. Continuous re‑evaluation is advised, as further reconnaissance may reveal additional indicators such as page payloads, credential‑capture URLs, or malicious redirects.