97ee9[.]catex[.]at

Analysis of the domain 97ee9.catex.at indicates a high-risk phishing operation targeting Coinbase users, as confirmed by multiple security vendors and blocklists. The domain, now offline, was flagged by 18 of 91 security vendors on VirusTotal, with additional blocking by PhishDestroy, MetaMask, and SEAL. Infrastructure analysis reveals the domain resolved to the IP address 31.59.121.53, hosted on AS56971 Cloud in France. The nameservers (a.dnspod.com, b.dnspod.com, c.dnspod.com) suggest a pattern commonly associated with malicious infrastructure.

The page title, 'Coinbase Dashboard,' aligns with the reported brand impersonation of Coinbase, though the exact content of the site remains unconfirmed due to its current offline status. The domain returned an HTTP 200 status code prior to takedown, indicating an active phishing page at the time of detection. SSL certification was provided by Let's Encrypt (YR1), a common but not exclusive indicator of legitimate or malicious sites.

The domain appears on three security blocklists, reinforcing its classification as malicious. Defenders should treat this domain as compromised and prioritize blocking or monitoring any residual connections to the associated IP or nameservers. Further investigation into related infrastructure, particularly domains sharing the same nameservers or hosting provider, is recommended to identify potential linked threats.