coinxs[.]ru

coinxs.ru is assessed as an elevated risk due to its involvement in generic phishing targeting cryptocurrency users. The domain was designed to impersonate a legitimate cryptocurrency exchange, presenting itself as a secure and commission-free service. The risk level is heightened based on its detection across multiple security platforms and its appearance on several blocklists, indicating broad recognition as a phishing threat.

Technical analysis provides substantial evidence supporting this assessment. The domain was registered on January 09, 2025, via REGRU-RU and utilized an SSL certificate issued by Google Trust Services. It resolved to the IP address 104.21.64.1 and leveraged Cloudflare with HTTP/3 for traffic management. VirusTotal results show 4 out of 95 security vendors have flagged this domain for malicious activity. The site appears on four prominent blocklists: Polkadot, Codeesura, PhishDestroy, and Enkrypt. Further, coinxs.ru has a Scamadviser trust score of 1 out of 100, reinforcing its classification as a high-risk domain. The site’s page title, written in Russian, aligns with typical cryptocurrency phishing lures, promising advantageous exchange rates and no registration requirements. The domain is currently offline, reducing immediate exposure but not mitigating the historical threat.

Mitigation for generic phishing threats such as coinxs.ru should include blocking the domain at the network and endpoint security level, reviewing historical logs for any attempted access, and educating users about common cryptocurrency phishing tactics. Organizations should update threat intelligence feeds to reflect the domain’s detection by multiple sources, and monitor for related domains or infrastructure that may attempt to circumvent current blocks. Continued vigilance is recommended, as similar domains may emerge leveraging comparable tactics and infrastructure.