coinex[.]plus

This domain, coinex.plus, is flagged as a cryptocurrency brand impersonation phishing resource targeting Google. Analysis indicates the site masquerades under the CoinEx brand, as evidenced by its page title, while structurally impersonating Google infrastructure. No direct evidence of a drainer kit was observed, though the domain aligns with known patterns of credential harvesting and wallet-draining campaigns targeting cryptocurrency users. Infrastructure analysis reveals the domain resolves to IP address 104.21.96.1, hosted on Cloudflare’s network (AS13335). Detection metrics include a VirusTotal score of 17/95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend legitimacy to phishing pages. Registrar details remain undisclosed, though the domain appears on a single security blocklist. No Google Safe Browsing (GSB) listing was recorded at the time of analysis. The domain has been taken offline, likely in response to security interventions. Despite its inactive status, residual risk persists due to the domain’s prior association with phishing activity. Organizations are advised to monitor for related infrastructure, including IP 104.21.96.1 and Cloudflare-hosted domains with similar naming conventions. Security teams should update blocklists to prevent re-emergence and conduct retrospective analysis to identify potential prior exposure.