coinex[.]kim

This report details the threat domain coinex.kim, which was identified as a cryptocurrency scam site impersonating the legitimate brand Aave. The site's page title presented itself as "CoinEx," indicating an attempt to deceive users into believing it was associated with a legitimate cryptocurrency exchange service. The primary threat posed by this domain was the potential for credential theft and financial fraud, as users may have been lured into providing sensitive information or sending cryptocurrency under false pretenses.

Technical analysis revealed that the domain was flagged by 5 out of 95 VirusTotal vendors as malicious. Detection was reported by alphaMountain.ai, CyRadar, Forcepoint ThreatSeeker, Fortinet, and Webroot. The domain was listed on 1 blocklist. The domain was created on 2026-02-21 and resolved to IP address 2606:4700:3030::6815:4452, located in the United States, and hosted by AS13335 Cloudflare, Inc. The SSL certificate was identified as WE1.

The domain is currently offline and down, with a risk score of 63. This high risk score, combined with the brand impersonation and multiple vendor detections, indicates a significant threat profile. The domain is no longer accessible, reducing the immediate risk to users.