distribution-topless[.]com

Distribution-topless.com was observed to host a brand‑impersonation campaign targeting Coinbase. The site was registered on August 06, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The domain lacks an SSL certificate and uses the Cloudflare nameservers may.ns.cloudflare.com and wilson.ns.cloudflare.com. The page title returned by the web server is “$TOPLESS DISTRIBUTION”, which does not contain any Coinbase branding but confirms the presence of a site under the listed domain.

Gridinsoft assigned a trust score of 0 out of 100, indicating a high likelihood of malicious intent. VirusTotal analysis recorded three positive detections out of ninety‑five scanners, and the domain appears on two independent blocklists, PhishDestroy and ScamSniffer, further corroborating its abusive nature. The campaign is currently offline, but the infrastructure components – notably the Cloudflare‑hosted IP and the registrar – remain active and could be reused for future impersonation attempts. Defenders should continue to block the domain and its associated IP at network perimeter devices, update detection signatures to include the observed page title and registrar information, and monitor for new domains registered with the same registrar that resolve to the same Cloudflare ASN.

Additional vigilance is advised for any emergent URLs that reference Coinbase, as the brand is explicitly listed as the impersonated target. The lack of HTTPS does not mitigate risk, because the site can still deliver malicious payloads or credential‑harvesting pages over HTTP. Continuous threat‑intel feeds should be consulted for any re‑appearance of the domain or similar patterns.