baopxer[.]cn

On 23 July 2026, baopxer.cn was identified as a high‑risk brand‑impersonation infrastructure targeting Coinbase users. The domain was registered on 7 March 2026 through Alibaba Cloud Computing Co., Ltd. (Wanwang) and is served by the authoritative name servers dns29.hichina.com and dns30.hichina.com. DNS resolution points to the single IPv4 address 103.70.76.110, which belongs to the Netsec Limited network (AS45753) located in Hong Kong. The web server is identified as Nginx with HTTP Strict Transport Security enabled, and the site presented a valid Let’s Encrypt certificate (R12).

The page title observed during the brief crawl was “比特币现货价格_合约价格差异解析‑CoinBase”, indicating a focus on Bitcoin pricing while explicitly mentioning the Coinbase brand. VirusTotal scans returned 13 positive detections out of 94 security vendors, and the domain appears on three external blocklists, including PhishDestroy, MetaMask, and SEAL. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment.

The site is currently offline, which limits real‑time verification of content, but the existing artifacts confirm a crypto‑focused impersonation campaign. Defenders should block traffic to 103.70.76.110 and to the domain itself at the DNS level, update URL filtering rules to include baopxer.cn, and monitor for any related sub‑domains that may be provisioned under the same registrar or name‑server pair. Additional scrutiny of outbound connections from internal hosts to the Hong Kong ASN is advised, as is the inclusion of the domain in threat‑intel feeds to prevent future phishing attempts leveraging the same brand narrative.