cryptoex[.]group

cryptoex.group is currently active and classified as a generic_phishing site with a high risk rating. The domain was registered on May 15, 2026 through Alibaba Cloud Computing Ltd. d/b/a HiChina and resolves to the Cloudflare IP address 104.18.7.167 located in Canada. HTTP requests receive a 301 redirect and the TLS certificate is issued by Google Trust Services under the WE1 label, indicating use of a legitimate certificate authority. The authoritative nameservers for the domain are randy.ns.cloudflare.com and addilyn.ns.cloudflare.com, confirming that the infrastructure is fully hosted on Cloudflare’s network. The page title advertised by the site reads “Safe & Secure Crypto Exchange | Buy & Sell Bitcoin | CoinW”, which aligns with the known scam type of a fake cryptocurrency exchange targeting users of the CoinW platform. Threat intelligence sources have placed cryptoex.group on a single security blocklist and it appears in one AlienVault OTX pulse. PhishDestroy has already blocked the domain, and VirusTotal reports that 1 of 95 scanning engines flagged the host as malicious. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. Publicly available information does not include a detailed content analysis of the landing page, so the exact visual spoofing techniques and credential‑capture mechanisms remain unverified. The limited number of detections suggests that the campaign may be in an early stage or using a low‑profile distribution vector, yet the combination of a high‑risk rating and a trusted TLS certificate warrants caution. Defenders should add cryptoex.group to network‑level deny lists and ensure DNS resolvers block queries to the domain. Monitoring of Cloudflare edge traffic for anomalous requests to the IP 104.18.7.167 can provide early indicators of exploitation attempts. User‑facing security awareness messages should reference the fake CoinW exchange theme to reduce the likelihood of credential submission.