coinmex[.]io

Analysis of coinmex.io, observed as an offline site as of July 23 2026, shows infrastructure typical of a brand‑impersonation campaign targeting Ethereum users. The domain was registered on 2026‑03‑03 through NiceNIC International Group Co., Limited and resolves to 172.67.153.56, an address owned by AS13335 Cloudflare, Inc., located in the United States. Both authoritative nameservers, marvin.ns.cloudflare.com and riya.ns.cloudflare.com, are Cloudflare‑managed, indicating the operator leveraged Cloudflare’s CDN and DDoS protection services. No TLS certificate was presented, meaning the site was reachable only over HTTP, which is consistent with many quick‑deployment phishing kits. The page title “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | CoinMex” explicitly references Ethereum, aligning with the listed brand target.

Automated scanning on VirusTotal recorded 14 positive detections out of 94 security engines, and the domain appears on a single external blocklist. PhishDestroy has also listed the domain as blocked. Gridinsoft assigned a trust score of 0 / 100, reinforcing the malicious assessment. Detected front‑end libraries include Chart.js, jsDelivr, cdnjs, and a Facebook Pixel, while Cloudflare Browser Insights and HTTP/3 indicate modern web delivery mechanisms. Current uncertainty revolves around the exact content served before takedown; no SSL certificate and the offline status limit direct observation of login forms or credential‑harvesting pages.

The absence of additional blocklist entries or community reports suggests limited distribution, but the presence of multiple detection signatures implies the site employed known malicious code or templates. Defenders should add 172.67.153.56 to network deny lists, monitor for future domains hosted on the same Cloudflare ASN, and enforce URL filtering for coinmex.io and any subdomains. Email gateways should flag messages referencing the exact page title or the “CoinMex” brand.