coinxes[.]io

The domain coinxes.io is currently active and presents a high‑risk profile consistent with a fake cryptocurrency exchange. The site returns HTTP 200 and advertises itself with the page title “Fast and Secure Cryptocurrency Exchange at Competitive Rates – coinxes.io.” The domain was registered on 2026‑02‑21 through NameSilo, LLC, and its SSL certificate is issued by Google Trust Services under the WE1 designation, indicating a legitimate‑looking TLS chain.

Infrastructure analysis shows the domain resolves to IP 104.21.112.1, a Cloudflare‑owned address (AS13335) located in the United States. Authoritative nameservers are thomas.ns.cloudflare.com and paige.ns.cloudflare.com, confirming use of Cloudflare’s DNS services. An MX record is present (priority 10, host mail.coinxes.io), and the site employs a stack of Node.js, Vue.js, Nuxt.js, Google Tag Manager, and HTTP/3, all typical of modern web applications but also useful for evading simple heuristic detection.

Threat intelligence flags coinxes.io as a fake exchange. The site received a Gridinsoft trust score of 0 / 100 and appears on one security blocklist. Two of ninety‑five VirusTotal scanners flagged the domain, providing independent confirmation of malicious intent. PhishDestroy has already blocked the domain, and the overall risk level is classified as high by the reporting system.

Defenders should immediately block coinxes.io at DNS and proxy layers, and add the associated IP address 104.21.112.1 to any network‑level deny lists. Continuous monitoring of the Cloudflare nameservers for any changes is advised, as attackers may pivot to new IPs under the same service. Users should be warned that any credential or payment request from this domain is fraudulent, and incident response teams should treat any related traffic as a potential credential‑theft attempt.