coinexglobals[.]org

Analysis of coinexglobals.org indicates a high‑risk brand impersonation operation targeting the "across" brand. The domain was registered on June 20, 2025 through GMO Internet Group, Inc. d/b/a Onamae.com and currently resolves to IP address 198.23.193.170, which belongs to AS36352 (HostPapa) in the United States. The authoritative name servers are ns1.geebytescloud.com and ns2.geebytescloud.com, and the MX record points to the domain itself with priority zero, a configuration often used to facilitate spam or phishing email delivery. The site presents a page titled "Coinextrading - Your Peddle to Better Profit" and serves content over HTTP/3 using a LiteSpeed web server. Detected client‑side components include YouTube embeds, jQuery, jQuery UI, JivoChat, GetButton, and Clipboard.js, suggesting attempts to increase credibility and enable user interaction. The SSL certificate is issued by Let’s Encrypt (R13), providing encryption but not authentication of the underlying entity.

Reputation services flag the domain as extremely untrustworthy: Scamadviser assigns a trust score of 1/100, Gridinsoft scores 0/100, and the domain appears on one security blocklist. VirusTotal analysis shows that three of ninety‑five scanned vendors flagged the site, reinforcing the malicious assessment. PhishDestroy has already blocked the domain, and the HTTP response code is 200, indicating the site is actively serving content.

Defenders should add coinexglobals.org to URL filtering and email security policies, block its IP address, and monitor for related DNS queries to the listed name servers. Because the domain impersonates the "across" brand, organizations using that brand should issue user warnings and educate employees about the fraudulent page title and the lack of legitimate affiliation. Continuous observation of any new infrastructure changes, such as additional IPs or altered certificate authorities, is recommended to detect potential evolution of the campaign.