mountain-allocation[.]xyz

This domain, mountain-allocation.xyz, poses a high-risk brand impersonation threat specifically targeting Coinbase users. Analysis indicates the site is designed to deceive visitors into believing they are interacting with the legitimate Coinbase platform, likely through credential harvesting or fraudulent transaction prompts. The page title, $MOUNTAIN DISTRIBUTION, suggests an attempt to lure victims with fabricated investment opportunities or distribution schemes, a common tactic in cryptocurrency-related phishing operations. Infrastructure analysis reveals multiple red flags. The domain was registered on January 25, 2026, through NiceNIC International Group Co., Limited, and resolves to the IP address 172.67.222.5, hosted on Cloudflare’s network (AS13335). It is flagged by 11 out of 95 security vendors on VirusTotal and appears on four distinct security blocklists, including PhishDestroy and ScamSniffer. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing domains frequently leverage valid certificates to appear legitimate. Users who have visited mountain-allocation.xyz should take immediate action to mitigate potential compromise. Disconnect any active sessions, revoke permissions for connected wallets or applications, and change passwords for associated accounts, particularly those linked to cryptocurrency platforms. Monitor financial accounts for unauthorized transactions and consider reporting the incident to relevant fraud authorities. If credentials were entered, assume they are compromised and avoid reusing them across other services. Technical indicators such as the domain’s creation date, IP resolution, and blocklist status should be incorporated into security tooling to prevent further exposure.