admin[.]stock-deepgtp[.]top

Analysis indicates that the domain admin.stock-deepgtp.top was registered on 21 February 2026 through Namemart Limited. The site presents the page title “Coinbase后台”, suggesting an attempt to impersonate the Coinbase brand. No TLS certificate is observed, so the service is reachable only via plain HTTP. DNS resolution returns the IPv4 address 134.122.140.226, which belongs to AS152194 (CTG Server Limited) and is geolocated in Japan. The authoritative name servers are ns1.domainnamedns.com and ns2.domainnamedns.com.

Reputation services show consistent malicious labeling. The domain appears on three independent security blocklists and is flagged by Google Safe Browsing for social‑engineering content. VirusTotal reports that 13 of 93 scanning engines have classified the host as malicious. Additional filtering platforms—PhishDestroy, MetaMask, and SEAL—have also blocked the domain. The overall risk assessment is high, and the site has been taken offline at the time of reporting.

The observed indicators align with a crypto‑scam campaign that targets users of the Coinbase platform. However, the exact content served, credential‑harvesting mechanisms, or any payload delivery has not been publicly captured, leaving those aspects unverified. Defenders should add the domain and its hosting IP to deny‑list rules, monitor for any resurrection of the host, and enforce TLS‑only policies to reduce exposure to non‑encrypted endpoints. Continuous observation of the registrar Namemart Limited and the associated name servers may reveal further related infrastructure. Until the site is fully taken down, organizations should treat any traffic to admin.stock-deepgtp.top as malicious and block it at network perimeters.