www-claim-bullish[.]xyz

This domain, www-claim-bullish.xyz, is actively flagged as a high-risk brand impersonation site targeting Coinbase users. Registered on November 21, 2025, through NiceNIC International Group Co., Limited, the domain resolves to IP address 172.67.212.204 and is protected by Cloudflare infrastructure, including Cloudflare Browser Insights and HTTP/3. The page title, $BULLISH Distribution, suggests a fraudulent cryptocurrency distribution scheme, though the exact mechanics of the scam remain unconfirmed due to lack of direct analysis of the site content. Analysis indicates that 6 out of 95 security vendors on VirusTotal have detected this domain as malicious, while AlienVault OTX records it in 23 threat intelligence pulses. The domain appears on three security blocklists and is actively blocked by at least three security tools. Despite its recent registration, the site maintains an SSL certificate issued by Google Trust Services, a common tactic to lend false legitimacy to phishing operations. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. Defenders should treat this domain as an active threat. The combination of brand impersonation, cryptocurrency-themed lures, and Cloudflare obfuscation aligns with known tactics used in credential harvesting and crypto drainer schemes. Network-level blocking is recommended, particularly for organizations handling cryptocurrency transactions or Coinbase-related services. While the domain’s infrastructure is well-documented, the absence of confirmed scam kit details or user interaction data limits attribution to a specific threat actor. Continuous monitoring for related domains registered through the same registrar is advised, as this may indicate a broader campaign.