coinex-vip63[.]com

Analysis indicates that coinex-vip63.com was flagged by multiple security sources as a generic phishing domain. The site was listed by PhishDestroy and appears on one security blocklist. VirusTotal records show that three of ninety‑five scanning engines returned a malicious classification, suggesting that at least some detection tools recognize malicious behavior. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the low credibility of the domain. The HTTP response is currently offline, and no SSL certificate was observed, meaning the site does not offer encrypted connections. The page title returned during the brief probe was "Home", providing no further context about the content or targeted brand.

Infrastructure investigation reveals that the domain resolves to the IP address 18.238.80.103, which belongs to Amazon.com, Inc. (AS16509) and is hosted in the United States. The domain uses four Amazon Route 53 nameservers (ns-1504.awsdns-60.org, ns-1819.awsdns-35.co.uk, ns-466.awsdns-58.com, ns-910.awsdns). Registration data shows the domain was created on 9 September 2025 and was registered through Amazon Registrar, Inc. No TLS certificate was presented, and the lack of HTTPS may be a deliberate choice to avoid certificate‑based reputation systems.

While the offline status limits immediate observation of malicious payloads, the combination of multiple vendor detections, a zero trust score, blocklist presence, and the generic “Home” title aligns with typical phishing infrastructure. Uncertainty remains regarding the specific phishing lure, target audience, and any credential‑stealing mechanisms that may have been deployed before the takedown. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the same IP or nameserver set, and consider adding the domain to internal blacklists.