coinex-vip55[.]com

Analysis of coinex-vip55.com indicates that the domain is currently offline but was previously identified as a social engineering vector. Google Safe Browsing classified the site under social engineering, and the domain appears on a single public blocklist. The lack of an SSL certificate means all HTTP traffic was unencrypted, facilitating credential harvesting. Infrastructure investigation shows the domain resolved to IP 13.226.94.119, hosted within Amazon's AS16509 network in the United States.

The four authoritative name servers—ns-1303.awsdns-34.org, ns-1603.awsdns-08.co.uk, ns-53.awsdns-06.com, and ns-802.awsdns-—are all part of Amazon Route 53, confirming the use of Amazon’s DNS services. The domain was registered on August 31 2025 through Amazon Registrar, Inc., suggesting a relatively recent creation date for malicious infrastructure. VirusTotal scans recorded detections from three out of ninety‑five antivirus engines, reinforcing the suspicion that the site hosted malicious content. Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high confidence in the domain’s malicious nature.

The only visible page element is the title "Home," and no additional content has been publicly captured, leaving the specific impersonated brand or service undefined. Defenders should continue to block the domain at perimeter and endpoint layers, update URL filtering policies to include the observed IP range, and monitor the associated Amazon‑hosted name servers for any re‑registration attempts. Given the low trust score and multi‑vendor detections, the domain should be treated as a high‑confidence phishing indicator until further evidence emerges.