coinfarex[.]com

coinfarex.com is currently active and classified as a high‑risk brand‑impersonation campaign targeting the Ethereum brand. The site returns an HTTP 302 redirect and advertises itself with the page title “Buy/Sell Bitcoin, Ether and Altcoins | Cryptocurrency Exchange | Coinfarex”. The title explicitly references Ether, confirming the impersonation of the Ethereum ecosystem.

The domain was registered on 21 Nov 2024 through NameSilo, LLC and resolves to 188.114.96.3, a Cloudflare (AS13335) address located in the United States. DNS is served by dylan.ns.cloudflare.com and liv.ns.cloudflare.com. The site uses a Let’s Encrypt R13 certificate and runs on Nginx, indicating a typical cloud‑hosted web stack rather than a bespoke phishing kit.

Reputation services assign extremely low trust scores: Scamadviser 1/100 and Gridinsoft 3/100. VirusTotal reports that 1 of 95 scanned security vendors flagged the domain, and the domain appears on a single security blocklist. It is also listed by PhishDestroy and was referenced in one AlienVault OTX pulse, reinforcing its malicious standing.

Defenders should block coinfarex.com at the DNS and proxy layers, enforce outbound filtering to prevent connections to its IP address, and add the domain to internal threat‑intel feeds. Continuous monitoring of TLS certificates and redirection behavior is advised, and any traffic that includes Ethereum‑related keywords should be inspected for possible credential or payment‑information exfiltration. Because the underlying page content has not been examined, further analysis of the landing page is required to determine whether credential capture or crypto‑draining functionality is present.