aa667[.]top

The domain aa667.top was observed hosting a cryptocurrency‑related impersonation campaign targeting Coinbase users. The site presented the page title “CoinbaseWallet”, indicating an attempt to lure victims into a wallet‑connect workflow. Analysis of the known intelligence shows that the campaign employed the “Wallet Connect Abuse” phishing kit, a known tool for hijacking wallet connections. The domain was registered through NameSilo, LLC on 21 February 2026 and resolves to IP 199.180.113.29, an address owned by AS25820 (IT7 Networks Inc) located in the United States. No TLS certificate was presented, meaning the site was served over plain HTTP.

Google Safe Browsing flagged the domain for social engineering, and three independent blocklists—PhishDestroy, MetaMask, and SEAL—have listed it as malicious. VirusTotal analysis recorded detections from 12 of 93 scanning engines, reinforcing the malicious classification. The authoritative nameservers are ns1.dnsowl.com, ns2.dnsowl.com, and ns3.dnsowl.com, which are commonly associated with disposable hosting used by threat actors. At the time of reporting (23 July 2026) the site was taken offline, so direct inspection of the landing page is not possible; consequently, details such as the exact HTML structure, credential‑stealing forms, or redirect behavior remain unverified.

Defenders should block connections to 199.180.113.29 and to the fully qualified domain aa667.top at the network perimeter. Email security gateways should add the domain to URL block lists, and endpoint protection solutions should incorporate the observed VirusTotal detections. Incident response teams should monitor for any residual phishing emails that reference Coinbase wallet login URLs and correlate them with the observed domain or its IP. Threat intelligence feeds should be updated to include the domain, its registrar, and the associated nameserver set to improve early detection of future replicas.