coinexwa[.]com

Analysis of coinexwa.com, created on 3 February 2024, shows that the domain resolves to 104.21.51.113, an address owned by Cloudflare (ASN 13335) located in the United States. The authoritative name servers are aarav.ns.cloudflare.com and kira.ns.cloudflare.com, indicating that the domain is using Cloudflare’s DNS service. The TLS certificate presented is a GoDaddy Secure Certificate Authority – G2 issued to GoDaddy.com, Inc., which is typical for domains registered through GoDaddy.com, LLC. HTTP headers reveal the use of Nginx and OpenResty as the web‑server stack. The page title returned from the site is “CoinEx”, while the intelligence file lists the brand target as Google and the scam type as a Tech Support Scam, confirming that the operator is attempting to masquerade as Google support services.

The domain appears on a single security blocklist, PhishDestroy, and one of ninety‑five VirusTotal scanners flagged it, suggesting at least minimal malicious reputation. Gridinsoft assigned a trust score of 39 out of 100, further indicating low credibility. The site is currently taken offline, which limits immediate exposure but does not eliminate the risk of re‑activation on the same infrastructure. Defenders should add 104.21.51.113 to network‑level deny lists, enforce DNS filtering for coinexwa.com, and monitor for any resurrection of the domain or reuse of the same IP range.

Continuous observation of Cloudflare‑hosted assets linked to the identified name servers is recommended, as attackers frequently recycle such services. Because the domain claims to impersonate Google, security teams should update brand‑monitoring rules to include this exact domain and flag any future resolution to the same IP or similar page‑title patterns.