coinexapp[.]ru

Analysis of coinexapp.ru indicates a high‑confidence brand‑impersonation threat targeting users of the CoinEx platform. The domain was registered on May 27, 2025 through the BEGET‑RU registrar and is hosted on the IP address 91.236.116.114, which belongs to AS42237 w1n ltd in Sweden. The name servers ns1.ns8t7.com and ns2.ns8t7.com resolve to the same IP, and no TLS certificate is presented, meaning the site operates without HTTPS protection. The page title returned by the server reads "CoinEx ™ | The Official Site 【UPDATED 2025】", directly mirroring the legitimate brand’s branding and reinforcing the impersonation claim.

Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one security blocklist, confirming that at least one protective feed has flagged it. PhishDestroy has already taken the domain offline, and AlienVault OTX includes it in a single threat‑intel pulse, providing additional corroboration from the threat‑sharing community. VirusTotal reports that 16 of 95 scanned security vendors flag the domain as malicious, indicating a consensus among multiple detection engines. The combination of a brand‑specific page title, lack of encryption, low trust score, and multiple independent detections suggests the infrastructure was deliberately crafted for credential harvesting or fraud.

Defenders should update their URL filtering rules to block coinexapp.ru, ensure that any outbound connections to the associated IP address are denied, and monitor for any residual traffic that may still be attempting to reach the host. Because the site is currently offline, ongoing observation is needed to detect possible re‑hosting under a different IP or domain. Organizations should also educate users about the risk of unsolicited links claiming to be official CoinEx communications, emphasizing verification of TLS certificates and the importance of accessing the service only through known, trusted URLs.