coinex[.]center

On July 24, 2026, analysis of the domain coinex.center indicates that the site has been taken offline but retains a number of indicators consistent with a tech‑support impersonation campaign targeting Google users. The public page title returned by the server was “CoinEx”, which does not match the advertised brand, yet Google Safe Browsing classifies the URL as a social‑engineering threat and the domain is listed on a single security blocklist. The site was flagged by PhishDestroy and two of ninety‑five VirusTotal scanners reported malicious activity, reinforcing the suspicion of abuse. Infrastructure examination shows that coinex.center resolves to the IP address 104.21.112.1, hosted within Cloudflare’s network (AS13335, United States). The authoritative nameservers are jessica.ns.cloudflare.com and leonidas.ns.cloudflare.com, both operated by Cloudflare.

TLS termination is provided by a certificate issued to “Google Trust Services / WE1”, suggesting the attackers have obtained a legitimate certificate, possibly via automated issuance, to increase credibility. The site employed modern web stacks, including Ant Design, React, and Amazon Web Services, and advertised security features such as HSTS and HTTP/3, indicating a relatively sophisticated deployment. The registrar listed for the domain is GoDaddy.com, LLC, a common choice for disposable or short‑lived malicious domains. No additional evidence regarding the site’s content, login pages, or payloads is available because the service is currently offline. Consequently, the exact phishing landing page and any credential‑harvesting mechanisms remain unknown.

Defenders should continue to block coinex.center at the network perimeter and update intrusion‑prevention signatures to include the observed IP address and associated Cloudflare nameservers. Monitoring of any new domains that resolve to the same IP range or that present similar TLS certificates is advised.