coinex[.]date

On 24 July 2026 the domain coinex.date was identified as a brand‑impersonation campaign targeting Google. The domain was created on 6 September 2025 and is registered through Gname.com Pte. Ltd. DNS resolution points to the IP address 172.67.134.41, which belongs to AS13335 Cloudflare, Inc., confirming that the site is hosted behind Cloudflare’s network. The authoritative nameservers are alla.ns.cloudflare.com and sonny.ns.cloudflare.com, consistent with the observed hosting. The TLS certificate presented is issued by Google Trust Services under the WE1 label, indicating that a legitimate Google certificate authority was leveraged, possibly through a mis‑issued or compromised certificate. The page title returned by the server is "CoinEx", which does not align with the advertised Google brand and suggests that the visible content may be unrelated to the claimed target. The site employed a stack that includes Ant Design, React, Amazon Web Services, HTTP/3, and Cloudflare Browser Insights, and HSTS was observed, all of which are typical of modern web applications but provide no further indication of malicious payloads.

Detection telemetry shows that 16 of 95 security vendors on VirusTotal flagged the domain, and the Gridinsoft trust score is 0 / 100, reflecting a high confidence of malicious intent. The domain appears on one security blocklist and has been explicitly blocked by PhishDestroy. The campaign is categorized as a Tech Support Scam, although the exact phishing vector or victim interaction flow has not been publicly disclosed. The current operational status is listed as offline, suggesting that the site has been taken down or is no longer serving content.

Defenders should continue to block coinex.date at the network perimeter and update endpoint security policies to reflect the observed detections. Monitoring of the associated IP range (172.67.134.