coinexb2[.]com
“CoinEx”
Resumo das evidências
Analysis of the domain coinexb2.com indicates it was actively involved in a phishing campaign targeting users of the CoinEx cryptocurrency exchange, as evidenced by its page title and classification in threat intelligence sources. The domain was registered on April 16, 2025, through InterNetX GmbH and is associated with Cloudflare infrastructure, resolving to the IPv6 address 2606:4700:3030::6815:3001, which is geolocated to the United States under AS13335 (Cloudflare, Inc.). Nameservers brit.ns.cloudflare.com and howard.ns.cloudflare.com further confirm Cloudflare hosting, and the site employed HTTP/3, a protocol commonly used to evade detection and enhance performance. The SSL certificate was issued by Google Trust Services (WE1), a legitimate provider often exploited by threat actors to lend credibility to malicious domains.
At the time of assessment, the domain was offline, returning an HTTP 403 status code, which may indicate takedown efforts or voluntary suspension by the hosting provider. Detection data reveals that coinexb2.com appeared on one security blocklist and was flagged by PhishDestroy, a specialized anti-phishing service. VirusTotal analysis reported that 2 out of 95 security vendors classified the domain as malicious, though this low detection rate does not preclude the possibility of targeted or evasive phishing activity. The domain's creation date, combined with its use of Cloudflare and a cryptocurrency-related page title, aligns with tactics observed in credential-harvesting campaigns.
Defenders are advised to treat coinexb2.com as a confirmed phishing domain and should update blocklists to prevent user access. Given the domain's association with Cloudflare, monitoring for re-emergence under different nameservers or IP ranges is recommended. Organizations should also review logs for connections to 2606:4700:3030::6815:3001 or related Cloudflare-hosted endpoints during the period of activity.
Data Coverage
Sinais de segurança
Pipeline de resposta a ameaças
Cobertura de listas de bloqueio
10 fontes externas monitoradas · instantâneo de 13/08/2026
10 fontes externas monitoradas Sem correspondência
Linha do tempo de detecção
-
Status do domínio
Acessível → Inacessível
-
Cloudflare Radar
Varredura do Cloudflare Radar armazenada · Abrir varredura
-
Cloudflare Radar
Varredura do Cloudflare Radar armazenada · Abrir varredura
-
Status do domínio
Inacessível → Acessível
Captura armazenada
Inteligência de Domínios
Detalhes técnicosDNS, nomes TLS e datas
ICANN OVERSIGHT
Credenciamento e contexto RAA
Credenciamento e contexto RAA
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Tecnologias
2 tecnologias identificadas com alta confiança
Análise do VirusTotal
Evidências arquivadas
Você foi afetado por este site?
Se você inseriu credenciais de conta, informações pessoais ou de pagamento, ou baixou um arquivo deste domínio, tome medidas imediatas. Abaixo estão os recursos para ajudá-lo a relatar o incidente e se proteger.
Notifique as autoridades locais
Selecione seu país para obter contactos oficiais do cibercrime ou crie um rascunho de reclamação →.
Verificar qualquer domínio
Análise de ameaças usando lista de bloqueio armazenada, WHOIS, DNS e evidências de verificação pública
Digitalize agoraDenunciar phishing
Envie domínios suspeitos para nosso banco de dados de ameaças — proteja a comunidade
DenunciarFeed de ameaças em tempo real
Relatórios recentes de phishing e alterações de disponibilidade observadas
MonitorarMantenha-se informado, mantenha-se seguro
Monitore ameaças em tempo real ou conteste esta listagem caso acredite que se trate de um falso positivo