coinelixholdings[.]live

This domain, coinelixholdings.live, is actively flagged as a high-risk brand impersonation threat targeting the financial or cryptocurrency sector. Registered on March 16, 2026, through Devexpanse Ltd operating as Regery.com, the domain resolves to the IP address 74.50.67.3. Infrastructure analysis reveals the use of WordPress, MySQL, PHP, and additional plugins such as Yoast SEO and LiteSpeed, which are commonly employed in both legitimate and malicious websites. The presence of these technologies does not inherently indicate malicious intent but suggests a structured web environment that could be exploited for phishing operations. The domain’s SSL certificate is issued by ZeroSSL GmbH, a provider frequently used in both benign and fraudulent sites. Detection metrics indicate significant suspicion: 12 out of 95 security vendors on VirusTotal have flagged the domain, while AlienVault OTX lists it in 23 threat intelligence pulses. These indicators, combined with its presence on two security blocklists and active blocking by PhishDestroy and BLP-Malware, reinforce the assessment of malicious activity. The page title, 'Home - Coinelix Holdings,' suggests an attempt to mimic a legitimate financial or investment entity, though no direct evidence confirms the specific brand being impersonated beyond the generic term 'across.' Uncertainties remain regarding the exact tactics employed by this campaign, as the domain remains operational as of July 12, 2026. The registrar, Regery.com, has been associated with other suspicious domains, though this alone does not confirm intent. Defenders should treat this domain as hostile and prioritize blocking or monitoring traffic to and from 74.50.67.3. Network-level protections, such as DNS filtering or IP-based restrictions, are recommended to mitigate potential exposure. Given the domain’s recent creation and persistent activity, further monitoring is advised to track any shifts in infrastructure or additional impersonation attempts.