coinblock[.]cx

On July 24, 2026 analysts examined the domain coinblock.cx, which is currently offline but was previously identified as a fake exchange phishing site. Registration data indicates the domain was created on January 07, 2026 through CentralNic Ltd, and it uses the nameservers dns1.registrar-servers.com and dns2.registrar-servers.com. DNS resolution points to IP address 216.150.1.1, an address owned by Vercel, Inc. in the United States, confirming the hosting platform detected as Vercel.

The site presented a TLS certificate issued by Let’s Encrypt (R13), and the only observed page title was "Vercel Security Checkpoint," suggesting a placeholder or security interstitial rather than a legitimate login page. Security instrumentation shows the domain appears on a single blocklist, PhishDestroy, and two of ninety-four VirusTotal scanners flagged it as malicious. Gridinsoft assigned a trust score of 35 out of 100, reflecting a low confidence level in the site's legitimacy.

No additional threat intelligence sources such as OTX or external brand mentions were found. Given the combination of recent registration, Vercel hosting, low trust score, limited blocklist presence, and the specific scam classification of fake exchange phishing, defenders should add coinblock.cx to web‑filter deny lists, monitor for any re‑activation, and enforce strict outbound controls to prevent credential harvesting. Continuous re‑evaluation is advised should the domain become active again or additional detections emerge.