coinex-vip64[.]com

Analysis of coinex-vip64.com indicates a recently created phishing infrastructure. The domain was registered on September 09 2025 through Amazon Registrar, Inc., and resolves to the Amazon-owned address 3.161.213.37 located in Canada under ASN 16509 (Amazon.com, Inc.). No TLS certificate is presented, and the site currently returns an offline HTTP status, confirming that the malicious content has been taken down. The public page title reported is "Home", but the page’s internal contents have not been captured, leaving the exact phishing lure unknown.

Infrastructure signals include four Amazon Route 53 nameservers (ns-1488.awsdns-58.org, ns-1902.awsdns-45.co.uk, ns-208.awsdns-26.com, ns-759.awsdns). The domain appears on a single security blocklist and is explicitly listed by PhishDestroy as a phishing-related entry. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. VirusTotal scans show that three of ninety-five antivirus engines flag the domain, and Google Safe Browsing classifies it as a social-engineering threat.

Given the combination of a low-trust score, blocklist presence, and detection by multiple vendors, the domain should be treated as a confirmed phishing vector. Defensive actions should include adding the domain and its resolving IP address to outbound and inbound filtering rules, updating URL and domain reputation feeds, and monitoring for newly created Amazon-hosted domains with similar characteristics. Analysts should also review any recent traffic logs for connections to 3.161.213.37 to identify potential victim exposure. Continuous observation of Amazon-owned IP ranges is recommended, as threat actors frequently leverage cloud infrastructure to host short-lived phishing sites.