coinex[.]cyou

On July 24, 2026 analysts observed that the domain coinex.cyou is currently offline but was previously associated with a tech‑support scam that impersonates Google. The domain resolves to the Cloudflare‑hosted address 172.67.173.197, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Registration data show the domain was created on May 23, 2025 and was registered through Gname.com Pte. Ltd., a registrar known to host a variety of transient malicious sites. The authoritative nameservers are elly.ns.cloudflare.com and margo.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure.

TLS inspection reveals a certificate issued by Google Trust Services under the WE1 intermediate, indicating that the attacker deliberately obtained a legitimate‑looking certificate to increase credibility. The site advertised the page title “CoinEx”, and automated fingerprinting detected the presence of Ant Design, React, Amazon Web Services, HTTP/3, HSTS, and Cloudflare as the underlying technology stack. VirusTotal scans recorded two positive detections out of ninety‑five security vendors, and the domain is listed on a single active blocklist, specifically PhishDestroy, which has already taken the address offline. The Gridinsoft trust score of 42 out of 100 reflects a moderate level of risk, consistent with the elevated risk rating assigned by the reporting system.

While the offline status limits immediate exposure, the combination of a reputable SSL certificate, Cloudflare hosting, and a short domain lifespan is characteristic of opportunistic phishing campaigns that rely on rapid deployment and takedown. Defenders should continue to monitor the IP address 172.67.173.197 for any re‑use, enforce blocklist updates to include coinex.cyou, and consider adding the domain to URL filtering policies that target Google impersonation attempts.