coinbaseax[.]com

This domain is flagged as an elevated-risk brand impersonation threat targeting Coinbase, a cryptocurrency exchange platform. The infrastructure was designed to deceive users into believing they were interacting with legitimate Coinbase services, though the page title, 'CMC Markets,' suggests either misdirection or an attempt to obfuscate the true intent of the site. Brand impersonation phishing of this nature typically aims to harvest credentials, financial information, or facilitate unauthorized transactions by exploiting user trust in the targeted brand.

Analysis of the domain reveals multiple technical indicators of malicious activity. The domain coinbaseax.com was registered on November 29, 2024, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolved to the IP address 104.21.78.98, which may be part of a content delivery network or proxy service used to mask the true origin of the phishing infrastructure. VirusTotal reports that 4 out of 95 security vendors flagged this domain as malicious, while Gridinsoft assigned it a trust score of 0/100. The domain appears on at least one security blocklist and is specifically blocked by PhishDestroy. The discrepancy between the intended brand impersonation (Coinbase) and the displayed page title (CMC Markets) further indicates an attempt to evade detection or confuse automated analysis tools.

Mitigation of this threat requires a multi-layered approach. Network-level defenses should block access to the domain and its associated IP address (104.21.78.98) to prevent user interaction. Organizations should update their email and web filtering rules to include this domain and its known indicators of compromise. End-users should be educated on recognizing brand impersonation tactics, particularly those involving cryptocurrency platforms, and encouraged to verify domain authenticity before entering credentials or financial details. Given the domain's current offline status, continuous monitoring for re-emergence or similar infrastructure is recommended, as threat actors often reuse tactics and registrars for subsequent campaigns.