bit-nest[.]me

This domain, bit-nest.me, is flagged as a brand impersonation phishing site targeting Coinbase users. Analysis indicates the page title 'BITNEST' was used to mimic the legitimate cryptocurrency exchange platform, likely aiming to harvest login credentials or facilitate unauthorized transactions. The domain exhibits characteristics consistent with credential theft campaigns, including the use of a deceptive interface designed to replicate the targeted brand's official portal.

Infrastructure analysis reveals the domain was registered on October 31, 2025, through Dynadot LLC and resolves to the IP address 172.67.181.223. Security vendor detections on VirusTotal report 12/95 flags, while Gridinsoft assigns a trust score of 0/100. The domain appears on two security blocklists, and ScamSniffer and PhishDestroy have both issued blocks. The SSL certificate is issued by Let's Encrypt, and the site employs Cloudflare Browser Insights and HTTP/3 technologies, which are commonly observed in phishing infrastructure to obfuscate malicious activity.

As of the latest assessment, bit-nest.me has been taken offline, reducing immediate exposure risk. However, the domain's recent creation date and prior malicious activity suggest residual risk remains. Users who interacted with the site are advised to rotate credentials immediately, monitor accounts for unauthorized activity, and verify the legitimacy of any communications purporting to originate from Coinbase. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts.