claim-mftttt[.]xyz

Analysis of claim-mftttt.xyz shows a high‑risk, brand‑impersonation infrastructure targeting Coinbase users. The domain was registered on February 21, 2026 through the registrar CV. Jogjacamp and resolves to the IP address 188.114.97.3, which belongs to Cloudflare (ASN 13335) and is geolocated in the United States. No TLS certificate is presented, indicating the site was served over plain HTTP before being taken offline.

The page title returned by the server is "Coinbase Wallet," directly matching the advertised brand and confirming the intent to mimic a legitimate Coinbase service. Google Safe Browsing classifies the site as a social‑engineering threat, and VirusTotal reports that seven of ninety‑three scanning engines have flagged the domain, reinforcing the malicious assessment. Independent blocklists, including PhishDestroy, MetaMask, and SEAL, have already added the domain to their deny lists, and the domain appears on three additional security blocklists. Gridinsoft assigns a trust score of 0 / 100, further indicating a lack of legitimacy.

While the exact phishing page content has not been captured, the convergence of brand impersonation, crypto‑scam labeling, and multiple vendor detections provides strong evidence of a credential‑harvesting or fund‑diversion operation. Defenders should ensure that DNS filtering rules block claim-mftttt.xyz, monitor outbound connections to the associated Cloudflare IP, and update endpoint protection signatures to include the listed blocklist identifiers. Incident response teams should also educate users about unsolicited requests for Coinbase credentials, as the site’s offline status does not preclude rapid re‑deployment on alternative hosting. Continued vigilance is recommended, especially for assets related to cryptocurrency wallets.