coinexagroup[.]com

The domain coinexagroup.com is a phishing site engaged in brand impersonation targeting users of the cryptocurrency platform Aave. It presents itself as a legitimate service to deceive victims into disclosing login credentials or sensitive information, a tactic known as brand impersonation phishing. As of the latest verification, coinexagroup.com has been taken offline, though its prior activity poses residual risks to users who may have interacted with it.

Technical indicators confirm the malicious nature of coinexagroup.com. The domain was flagged by 2 of 95 security vendors on VirusTotal, including CRDF and Gridinsoft, which assigned it a trust score of 4 out of 100. It appears on one security blocklist, PhishDestroy, and was registered through Gname.com Pte. Ltd. on August 24, 2025. The site resolved to the IP address 104.21.33.146, hosted by Cloudflare in the US, and lacked an SSL certificate. The observed page title was 'CoinEx,' further indicating an attempt to mislead users. No drainer kit was associated with this domain.

Users who visited coinexagroup.com should immediately change their Aave account passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized transactions or login attempts. If credentials were entered on the site, consider revoking any active token approvals and transferring funds to a new wallet as a precaution. Report the domain to relevant platforms, including Aave’s official security channels, and submit it to threat intelligence feeds like PhishTank or Google Safe Browsing to aid in broader protection efforts.