cetusexm[.]pro

The domain cetusexm.pro is actively engaged in crypto wallet drainer phishing, specifically impersonating Coinbase to deceive users into connecting their wallets. Analysis indicates this is a targeted attack designed to siphon cryptocurrency assets by presenting a fraudulent interface labeled 'Access Cetus using Coinbase Wallet.' The domain remains operational and poses an elevated risk to users unfamiliar with the legitimate Coinbase infrastructure. Infrastructure analysis reveals cetusexm.pro was registered through Name.com, Inc. and resolves to the IP address 103.179.44.107. It appears on three security blocklists and is flagged by 3 of 95 security vendors on VirusTotal, indicating malicious activity. Additional technical indicators include a Gridinsoft trust score of 0/100 and detection by wallet security mechanisms such as MetaMask and SEAL. The site employs Google Cloud, Nginx, and Google Cloud CDN technologies, which may be leveraged to obfuscate its true origin or scale the attack. Current status confirms cetusexm.pro remains active and continues to present a credible threat to cryptocurrency users. Immediate mitigation steps include blocking the domain and associated IP at the network level, as well as alerting users to verify the authenticity of any Coinbase-related prompts before interacting with them. Security teams are advised to monitor for additional domains registered through the same registrar or resolving to the same IP, as these may represent related threat infrastructure. Users should be educated on recognizing phishing attempts, particularly those involving wallet connections or requests for sensitive credentials.