coinex[.]qpon

The domain coinex.qpon has been identified as a brand impersonation threat, specifically targeting Google while presenting a page titled CoinEx. This domain is currently offline, indicating that hosting providers or authorities have taken action to disrupt its malicious operations. The site was designed to deceive users by masquerading as a legitimate Google-branded service, potentially to harvest sensitive information such as login credentials or financial data.

Technical analysis reveals several red flags. The domain was registered on May 23, 2025, through Gname.com Pte. Ltd., a registrar sometimes associated with suspicious domains. It resolves to IP address 104.21.64.1 and uses an SSL certificate from Google Trust Services, which adds a false sense of legitimacy. PhishDestroy's intelligence shows that coinex.qpon appears on 1 security blocklist and has been flagged by 3 out of 95 VirusTotal vendors, indicating moderate detection among security tools. The domain's creation date is very recent, a common characteristic of phishing sites that are quickly taken down after being reported.

As the site is offline, immediate risk to users is low, but similar domains may remain active. Users are advised to avoid clicking on links from unsolicited messages or emails claiming to be from Google or CoinEx, especially those directing to unfamiliar domains. Always verify URLs by typing them manually into the browser and enable multi-factor authentication on accounts for added protection. PhishDestroy recommends reporting any suspicious domains to security teams and staying vigilant against evolving impersonation tactics.