coinex[.]kg

The domain coinex.kg is currently active and has been identified as a Telegram impersonation site. The page title returned by the server is "Coinex.kg - провайдер криптовалютной ликвидности", indicating a claim of cryptocurrency liquidity services, yet the listed brand target is Telegram. No visual inspection has been performed, so the exact user‑facing content remains unverified. Infrastructure analysis shows the domain resolves to IP 195.38.165.5, hosted in Kyrgyzstan under ASN AS8511 (ASIAINFO TE). The web server reports HTTP 200 and runs Nginx with a WordPress stack built on PHP, MySQL, Bootstrap, Yoast SEO, and Plesk. TLS is provided by a Let's Encrypt R13 certificate. DNS is served by Cloudflare (keaton.ns.cloudflare.com, kim.ns.cloudflare.com) and the MX record points to mx.yandex.net with priority 10. Threat intelligence indicates the site is listed on one security blocklist and has been blocked by PhishDestroy. VirusTotal scans return 0/95 detections, which reflects a lack of prior reporting rather than a safety signal. The risk level is marked as under investigation, and the current status remains active. Defenders should add coinex.kg to domain denylists and configure email gateways to reject messages from its MX host. Network monitoring should include outbound connections to the identified IP and DNS queries for the domain. Continuous re‑scanning with multi‑engine services is advised to capture any future malicious payloads, and any observed credential traffic should be investigated for possible credential harvesting attempts.