coinexb2[.]com

Analysis of the domain coinexb2.com indicates it was actively involved in a phishing campaign targeting users of the CoinEx cryptocurrency exchange, as evidenced by its page title and classification in threat intelligence sources. The domain was registered on April 16, 2025, through InterNetX GmbH and is associated with Cloudflare infrastructure, resolving to the IPv6 address 2606:4700:3030::6815:3001, which is geolocated to the United States under AS13335 (Cloudflare, Inc.). Nameservers brit.ns.cloudflare.com and howard.ns.cloudflare.com further confirm Cloudflare hosting, and the site employed HTTP/3, a protocol commonly used to evade detection and enhance performance. The SSL certificate was issued by Google Trust Services (WE1), a legitimate provider often exploited by threat actors to lend credibility to malicious domains.

At the time of assessment, the domain was offline, returning an HTTP 403 status code, which may indicate takedown efforts or voluntary suspension by the hosting provider. Detection data reveals that coinexb2.com appeared on one security blocklist and was flagged by PhishDestroy, a specialized anti-phishing service. VirusTotal analysis reported that 2 out of 95 security vendors classified the domain as malicious, though this low detection rate does not preclude the possibility of targeted or evasive phishing activity. The domain's creation date, combined with its use of Cloudflare and a cryptocurrency-related page title, aligns with tactics observed in credential-harvesting campaigns.

Defenders are advised to treat coinexb2.com as a confirmed phishing domain and should update blocklists to prevent user access. Given the domain's association with Cloudflare, monitoring for re-emergence under different nameservers or IP ranges is recommended. Organizations should also review logs for connections to 2606:4700:3030::6815:3001 or related Cloudflare-hosted endpoints during the period of activity.