coinex-wallet[.]xyz

On July 25, 2026, the domain coinex-wallet.xyz was observed to host a crypto‑related impersonation campaign targeting the brand Across. The site’s HTML title was recorded as “Genius”, which does not directly reference the victim brand but is consistent with prior Across‑related phishing deployments that use unrelated titles to obscure intent. The domain was registered on 21 February 2026 and resolves to the IPv4 address 202.162.108.16, which is allocated to AS64050 BGP Network Limited in Singapore. Reputation services have flagged the hosting IP, and the domain appears on at least one public security blocklist.

The SSL certificate presented for the domain is identified as “R10”, indicating a low‑trust certificate that lacks extended validation. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious nature of the host. VirusTotal analysis shows that 9 of 93 scanning engines returned a positive detection, confirming that multiple anti‑malware products recognize the domain as suspicious. PhishDestroy has actively blocked the domain, and the current online status is recorded as offline, suggesting that the operator may have taken the site down following takedown efforts.

The campaign is categorized as a crypto scam, implying that any URLs under this domain were likely used to solicit cryptocurrency transfers or private keys from victims. While the page title and SSL details are known, the exact content served, such as login forms or credential‑harvesting pages, has not been captured. Consequently, defenders should continue to monitor the IP address 202.162.108.16 for any re‑use, enforce blocklist updates that include coinex‑wallet.xyz, and consider adding the domain to internal deny lists. Network traffic destined for the domain should be flagged for further inspection, and any endpoint detections that reference the “Genius” page title or the Across brand should be investigated as potential remnants of this campaign.