coinwdfx[.]com

Analysis of coinwdfx.com, created on 24 December 2024 and presently taken offline, shows a clear pattern of brand impersonation targeting Binance. The site presented a page title of COINW and was classified as a social media phishing campaign. No TLS certificate was observed, indicating the site operated over plain HTTP, which is typical for low‑effort phishing infrastructure. Registration was performed through Key-Systems GmbH, and the domain resolves to IP address 85.121.148.223, which is hosted in Moldova under ASN 48753 (AVA HOST SRL).

The hosting provider is associated with a single nameserver configuration. The domain appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal scans report detections by seven of ninety‑five vendors, reinforcing the malicious assessment. Independent reputation services assign extremely low trust scores—Gridinsoft 1/100 and Scamadviser 1/100—consistent with a high‑confidence malicious classification.

The combination of a recent creation date, lack of SSL, low reputation metrics, and confirmed impersonation of Binance suggests the domain was used to lure victims via social media links. Defenders should ensure the domain and its hosting IP are added to network deny lists, monitor the registrar Key-Systems GmbH for similarly patterned registrations, and watch for re‑use of the IP address by future phishing campaigns. Continuous threat‑intel feeds should be consulted for any resurgence of the domain or related indicators.