buydomainxtest[.]top

This domain is flagged as a high-risk credential theft site specifically targeting users of the cryptocurrency exchange platform Coinbase. Analysis indicates the site employs brand impersonation techniques to deceive victims into disclosing sensitive authentication credentials, including access codes and account details, which could lead to unauthorized account access and financial loss. Infrastructure analysis reveals the domain buydomainxtest.top was registered on June 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It currently resolves to the IP address 104.21.39.123 and presents a page titled 'Coinbase - Access Code Verification.' The site is secured with an SSL certificate issued by Google Trust Services, which may lend an appearance of legitimacy to unsuspecting users. Detection metrics show limited initial coverage, with only 1 out of 95 security vendors flagging the domain on VirusTotal. Additionally, the domain appears in one threat intelligence pulse on AlienVault OTX, suggesting early-stage recognition within the security community. Mitigation against this credential theft campaign requires immediate action from both users and network defenders. Users who encounter this domain should avoid interacting with the site and report it to their security teams. Network-level protections should include blocking the domain and its resolving IP address (104.21.39.123) at firewalls and DNS filters. Organizations are advised to implement multi-factor authentication (MFA) for all cryptocurrency-related accounts and conduct user awareness training to recognize brand impersonation tactics. Monitoring for similar domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED may help identify related threats.