coinex-vip5[.]com

This domain is flagged as an elevated-risk crypto wallet drainer phishing site targeting cryptocurrency users through brand impersonation. Analysis indicates the domain coinex-vip5.com was specifically engineered to deceive victims into connecting wallets, enabling unauthorized fund transfers via malicious smart contract interactions. The threat type aligns with known wallet drainer campaigns, where attackers exploit trust in legitimate exchange branding to execute fraudulent transactions. Infrastructure analysis reveals the domain was registered on June 25, 2025, through Amazon Registrar, Inc., and resolves to the IP address 3.161.82.37. The site employs Amazon Web Services and Amazon CloudFront for hosting and content delivery, with an SSL certificate issued by Amazon. Detection metrics show 3 out of 95 security vendors on VirusTotal flagged the domain as malicious, while one security blocklist has incorporated it into their filtering systems. The domain is currently offline, though its prior operational status and technical configuration suggest a deliberate attempt to evade detection while maintaining scalability. Mitigation against crypto wallet drainer threats requires heightened vigilance when interacting with exchange-themed domains. Users should verify domain registration dates via WHOIS records, cross-check resolved IPs against known legitimate infrastructure, and avoid connecting wallets to unverified platforms. Browser-based security extensions that block known phishing domains provide an additional layer of protection. In cases of suspected exposure, affected parties should immediately revoke wallet permissions, transfer remaining funds to a new secure wallet, and monitor transaction histories for unauthorized activity. Organizations managing cryptocurrency services are advised to proactively monitor for domains mimicking their branding and issue takedown requests through registrars or hosting providers.