kshxbzxc[.]top

This domain, kshxbzxc.top, is flagged as a high-risk brand impersonation threat targeting Coinbase. The site impersonates the legitimate Coinbase login page, aiming to trick users into entering their credentials, which can lead to account compromise and potential financial loss.

Analysis indicates that kshxbzxc.top has been flagged by 16 out of 95 security vendors on VirusTotal, marking it as a phishing site. The domain was registered through Dominet (HK) Limited on December 17, 2025, and currently resolves to the IP address 104.21.54.105, which is located in the United States and is associated with Cloudflare, Inc. The site appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, further confirming its malicious intent.

If users have visited kshxbzxc.top, they should immediately change their Coinbase account passwords and enable two-factor authentication (2FA) if not already active. It is also recommended to monitor account activity and credit reports for any unusual transactions. Users should report any suspicious activity to Coinbase support and avoid clicking on links from unknown sources in the future.