coinex-vip61[.]com

Analysis of coinex-vip61.com reveals infrastructure consistent with phishing operations targeting cryptocurrency exchange users. The domain was registered on September 5, 2025, through Amazon Registrar, Inc., and resolves to IP address 3.171.38.73, hosted on Amazon.com, Inc.'s network (AS16509) in the United States. The domain's nameservers are configured under AWS DNS services (awsdns-15.org, awsdns-01.co.uk, awsdns-05.com, and awsdns-57.net), a common pattern for threat actors leveraging cloud infrastructure for rapid deployment and takedown evasion. The domain is flagged by one security blocklist (PhishDestroy) and has been detected by 3 of 95 security vendors on VirusTotal, indicating moderate but not universal recognition as malicious.

Gridinsoft assigns a trust score of 0/100, further supporting its classification as high-risk. The page title 'Home' provides no explicit brand confirmation, but the domain name 'coinex-vip61' strongly suggests an attempt to impersonate CoinEx, a known cryptocurrency exchange, likely to deceive users into submitting login credentials or financial details. No SSL certificate is present, a red flag for any site handling sensitive information. As of July 24, 2026, the domain is offline, which may indicate a takedown or temporary suspension by the hosting provider.

Defenders should treat this domain as malicious and block it at the DNS and network levels. While the exact content of the site remains unanalyzed, the combination of cloud-based hosting, recent registration, low trust scores, and blocklist presence provides sufficient evidence to classify coinex-vip61.com as a phishing domain targeting cryptocurrency users. Further monitoring of associated IP ranges and registrar activity is recommended to identify related threats.