coinchanger[.]cx

On 24 July 2026 analysts observed that the domain coinchanger.cx is currently offline but retains indicators of a Binance brand impersonation campaign. The site was registered on 25 July 2024 through CentralNic Ltd and resolves to the IPv4 address 91.222.173.30, which is assigned to AS43641 SOLLUTIUM EU Sp z.o.o. in the Netherlands. DNS resolution is served by the authoritative name servers ns1-us.v-sys.org and ns2-us.v-sys.org, both of which are commonly associated with malicious hosting infrastructure. The web server identified by passive fingerprinting runs Nginx and presents a TLS certificate issued by Let’s Encrypt (R12), confirming that encrypted HTTPS was available while the site was active.

The page title returned during the brief window of availability was “CoinChanger | Swap & Withdraw – Cryptocurrency Exchange”, aligning with the declared scam type of a crypto‑draining operation. The domain is explicitly flagged as impersonating Binance, indicating an attempt to harvest credentials or funds from users of the exchange. Reputation services rate the domain poorly: Scamadviser assigns a trust score of 1 / 100, Gridinsoft 39 / 100, and the site appears on at least one public blocklist. VirusTotal analysis shows that five of ninety‑five scanning engines flagged the domain, confirming malicious characteristics despite the modest detection count. The domain has been added to the PhishDestroy blocklist, and its current offline status suggests that the operators have either withdrawn the site or are rotating infrastructure.

However, the underlying hosting provider, IP address, and name servers remain active and may be reused for future campaigns. Defenders should continue to monitor the IP 91.222.173.30, the associated ASN, and the v‑sys.org name servers for new hostings that reference Binance or display similar page titles.