test[.]coinbasex[.]info

This domain, test.coinbasex.info, is identified as a brand impersonation threat targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates the site likely functioned as a fake login portal designed to harvest user credentials or facilitate unauthorized account access. No direct evidence of a crypto drainer kit was observed, but the domain’s structure and page title (coinbasex.info) suggest an intent to deceive users into entering sensitive information under the guise of the legitimate Coinbase service. Infrastructure analysis reveals the following technical indicators: the domain was created on November 20, 2024, and registered through Porkbun LLC. It resolved to the IP address 199.59.243.228 and was flagged by 6 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and was assigned a trust score of 0/100 by Gridinsoft. Google Safe Browsing (GSB) status was not explicitly provided, but the domain’s detection rate and blocklist inclusion align with known phishing infrastructure patterns. As of the latest assessment, test.coinbasex.info has been taken offline, likely due to enforcement actions by security providers or the registrar. However, residual risk remains for users who may have interacted with the domain prior to its deactivation. Organizations and individuals are advised to monitor for unauthorized access attempts linked to this domain, reset credentials for any accounts accessed during the exposure window, and implement additional authentication measures for cryptocurrency-related services. Proactive blocklisting of the domain and associated IP address is recommended to prevent potential re-emergence or lateral movement within compromised networks.