coinex-vip66[.]com

The domain coinex-vip66.com is a confirmed phishing site engaged in brand impersonation targeting the Base cryptocurrency platform. It operates as a seed-phishing scam, attempting to deceive users into revealing sensitive information or wallet credentials under the guise of a legitimate service. No drainer kit was identified in this campaign. The site is currently taken offline, reducing immediate risk but not eliminating the potential for future malicious activity.

Technical indicators confirm the domain's malicious nature. coinex-vip66.com was flagged by 1 of 95 security vendors on VirusTotal, including Gridinsoft, which assigned a trust score of 0/100. It appears on one security blocklist, PhishDestroy. The domain was registered through Amazon Registrar, Inc. on February 21, 2026, and resolves to the IP address 18.245.46.9, located in Germany under AS16509 (Amazon.com, Inc.). The SSL certificate is issued by Amazon RSA 2048 M04, and the domain uses Amazon Route 53 nameservers. No page title was observed during analysis.

Users who interacted with coinex-vip66.com should take immediate action to secure their accounts and assets. If wallet credentials were entered, revoke any token approvals and transfer funds to a new wallet to prevent unauthorized access. For credential phishing, change passwords on all associated accounts and enable two-factor authentication (2FA) where available. Monitor accounts for suspicious activity and report the domain to relevant platforms, including Google Safe Browsing, PhishTank, or the impersonated brand's security team. Victims may also file complaints with local cybercrime authorities or organizations like the FBI's IC3.