coeyyccxx[.]top

This domain, coeyyccxx.top, is identified as a high-risk phishing resource specializing in brand impersonation targeting Coinbase, a major cryptocurrency exchange platform. The page title explicitly mimics the legitimate Coinbase interface, presenting itself as the official login portal to deceive users into submitting sensitive credentials, including wallet access details and two-factor authentication codes. No evidence of a drainer kit was observed in initial analysis, though the domain’s infrastructure aligns with credential-harvesting campaigns commonly deployed against financial and crypto-related services. Infrastructure analysis reveals the domain was registered on October 23, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with malicious domain registrations. The domain resolves to the IP address 103.108.41.18, hosted under AS135581 (ONL-HK) in Hong Kong, a region recurrently linked to phishing and fraudulent hosting providers. Detection metrics indicate 17 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Google Safe Browsing explicitly classifies it as a phishing threat. Additionally, the domain appears on one security blocklist, further corroborating its malicious classification. Notably, the absence of an SSL certificate suggests either a lack of operational sophistication or an attempt to evade automated detection systems that prioritize encrypted connections. As of the latest assessment, coeyyccxx.top has been taken offline, likely in response to detection and reporting by security entities. However, the residual risk remains elevated due to the domain’s recent registration and the transient nature of phishing infrastructure, which may re-emerge under altered identifiers. Organizations and end-users are advised to implement proactive measures, including real-time domain monitoring, DNS-based blocking of newly registered domains with similar patterns, and user education on recognizing brand impersonation tactics. Network administrators should also consider sinkholing traffic to the associated IP address (103.108.41.18) to mitigate potential lateral movement or secondary infections from compromised credentials.