coinbext[.]xin

This domain, coinbext.xin, is identified as a high-risk phishing infrastructure specifically designed to compromise cryptocurrency wallet credentials and facilitate unauthorized asset transfers. Analysis indicates the site mimics legitimate cryptocurrency exchange interfaces to deceive users into entering private keys, recovery phrases, or login credentials. The fraudulent nature of this domain is further evidenced by its use of social engineering tactics, including fake login portals and transaction prompts, which are characteristic of targeted wallet-drain attacks. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain resolves to the IP address 162.241.85.94 and was registered through Eranet International Limited on May 15, 2026, a future-dated registration that may indicate an attempt to evade detection or prolong operational use. As of the latest scans, coinbext.xin appears on three security blocklists, while VirusTotal reports detection by 18 out of 95 security vendors. The domain employs a Let's Encrypt SSL certificate (R12), which, while providing encryption, does not validate the legitimacy of the site. The page title 'Not Acceptable!' suggests either a misconfiguration or an attempt to evade automated security crawlers. Users who have interacted with coinbext.xin are advised to take immediate remedial actions to mitigate potential financial losses. Any credentials, private keys, or recovery phrases entered on this domain should be considered compromised and must be revoked or transferred to new, secure wallets. Affected users should also monitor their transaction histories for unauthorized activity and report any suspicious transfers to their wallet providers or relevant financial authorities. Additionally, system scans using updated security tools are recommended to detect any residual malware or tracking scripts that may have been deployed during the interaction. Proactive measures, such as enabling multi-factor authentication and verifying domain authenticity before entering sensitive information, are critical to preventing future exposure to similar threats.