coinex-vip777[.]com

The domain coinex-vip777.com was registered on September 09, 2025 through Amazon Registrar, Inc. and resolves to the IP address 18.164.124.59, which is hosted by Amazon.com, Inc. (AS16509) in the United States. The authoritative name servers are ns-1417.awsdns-49.org, ns-1883.awsdns-43.co.uk, ns-220.awsdns-27.com, and ns-799.awsdns, consistent with the Amazon DNS infrastructure. The site presented a page title of "Home" but no SSL certificate was observed, indicating that the service was delivered over plain HTTP. VirusTotal recorded a single positive detection out of ninety‑five scanners, and Google Safe Browsing classified the domain as a social engineering threat.

The domain is listed on one security blocklist and has been flagged by PhishDestroy. Gridinsoft assigned a trust score of zero out of one hundred, reflecting an extremely low confidence level in the site’s legitimacy. As of the report date, July 22, 2026, the domain is offline, but its historical activity suggests it was used for a generic phishing campaign. The evidence confirms that the infrastructure is tied to a reputable cloud provider, which can obscure malicious activity, and that multiple detection mechanisms have identified the domain as malicious.

Uncertainty remains regarding the specific payload or credential‑harvesting techniques employed, as no detailed page content analysis is available. Defenders should continue to block the domain at network perimeters, monitor DNS queries for the listed name servers, and consider adding the IP address 18.164.124.59 to threat intelligence feeds. Ongoing observation of the registrar’s activity may reveal additional domains leveraging the same AWS infrastructure for similar campaigns.