jimothy-coin[.]xyz

Analysis of the domain jimothy-coin.xyz as of 2026-08-05 shows that it is actively hosted and currently resolves to the IP address 188.114.96.3. The domain was registered on 2026-07-28 through PDR Ltd. d/b/a PublicDomainRegistry.com and is served by Cloudflare nameservers dexter.ns.cloudflare.com and macy.ns.cloudflare.com. The domain appears on a single public security blocklist and is listed as blocked by the PhishDestroy feed, indicating that at least one external sinkhole or filtering service has identified it as malicious. VirusTotal records show that the domain has been scanned by 91 antivirus or URL-reputation vendors; none of the scanners reported a detection at the time of the scan.

Although the lack of detections does not confirm the domain is benign, it demonstrates that the current signature base has not yet flagged the observed activity. No public Safe Browsing, Open Threat Exchange, or additional blocklist entries are presently associated with the domain, and no SSL certificate details, HTTP response codes, page titles, or content snapshots have been published in the available intelligence. Consequently, the exact nature of the phishing payload, the targeted brand, or any credential-harvesting pages remain unknown. Defenders should block or sinkhole the domain at network perimeter devices, update URL filtering lists to include jimothy-coin.xyz, and monitor outbound DNS queries for the associated Cloudflare nameservers.

Because the domain is hosted on a Cloudflare edge, further investigation of the underlying origin IP (188.114.96.3) may reveal additional infrastructure used by the threat actor. Continuous re-scanning with VirusTotal or similar services is advised to capture any future detection updates. Incident response teams should treat any traffic to this domain as potentially malicious and enforce credential-validation controls for users who may encounter phishing attempts referencing the "jimothy-coin" identifier.