coinchanger[.]info

Analysis of coinchanger.info as of July 24, 2026, confirms active brand impersonation targeting Binance, a major cryptocurrency exchange. The domain resolves to IP 91.222.173.30, hosted on AS43641 (SOLLUTIUM EU Sp z.o.o., Netherlands). A 301 HTTP redirect is currently in place, suggesting an attempt to forward visitors to another malicious endpoint. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as fraudulent domains frequently use valid certificates to appear legitimate. Infrastructure analysis reveals the domain is registered through Vsys_USA (ASN: 43641), a registrar previously associated with phishing activity.

Nameservers ns1-us.v-sys.org and ns2-us.v-sys.org further link the domain to this provider. The page title, 'CoinChanger #1 - Your Premier Crypto Exchange for Withdrawal & Transfer,' explicitly mimics cryptocurrency exchange terminology, reinforcing the brand impersonation classification. Detection data shows 5 of 95 security vendors on VirusTotal flag the domain, while PhishDestroy and one additional blocklist have already listed it. Trust scores from Scamadviser and Gridinsoft both rate the domain at 1/100, indicating high confidence in its malicious nature.

Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments handling cryptocurrency transactions. The combination of brand impersonation, low trust scores, and active blocklist presence provides sufficient evidence for immediate action. While the exact content of the phishing pages remains unanalyzed, the infrastructure and detection patterns align with known Binance-themed scams. Further investigation into the redirect target and any associated wallet addresses is recommended to disrupt the broader campaign.