connbbxxa[.]top

This domain, connbbxxa.top, poses a high-risk brand impersonation threat targeting users of the cryptocurrency exchange Coinbase. Analysis indicates the domain was designed to mimic the legitimate Coinbase platform, presenting an identical page title, 'Coinbase,' to deceive visitors into entering sensitive credentials, such as login details or wallet recovery phrases. Such impersonation schemes are commonly used to facilitate unauthorized access to user accounts, leading to financial theft or further exploitation through secondary attack vectors, including crypto drainers or malware distribution. The domain’s infrastructure and content were engineered to exploit trust in the Coinbase brand, increasing the likelihood of successful phishing attempts against unsuspecting users.

Technical evidence underscores the malicious nature of connbbxxa.top. The domain was registered on October 20, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 103.108.41.18, located in Hong Kong under autonomous system AS135581. Security vendors on VirusTotal flagged the domain as malicious, with 11 out of 95 engines detecting it as a phishing threat. Additionally, the domain appears on one security blocklist and is explicitly labeled as phishing by Google Safe Browsing. The absence of an SSL certificate further indicates a lack of basic security measures, a common characteristic of fraudulent sites designed for short-term exploitation before being taken offline.

Users who visited connbbxxa.top or entered credentials on the site should take immediate action to mitigate potential risks. First, any passwords or recovery phrases submitted must be considered compromised and changed immediately on the legitimate Coinbase platform. Enable multi-factor authentication (MFA) if not already active, using an authenticator app or hardware key rather than SMS-based methods. Monitor Coinbase accounts for unauthorized transactions or suspicious activity, and report any anomalies to the platform’s support team. Additionally, scan local devices for malware, as phishing sites may deploy secondary payloads. If financial loss is suspected, contact relevant financial institutions to initiate fraud investigations. Given the domain’s current offline status, users should remain vigilant for similar impersonation attempts, verifying domain authenticity before interacting with any cryptocurrency-related websites.