coeettrr[.]top

This domain is classified as a high-risk credential-theft phishing site specifically targeting Coinbase users. Analysis indicates the infrastructure was designed to harvest login credentials, authentication tokens, or financial details through brand impersonation techniques. The threat type aligns with known patterns of cryptocurrency exchange phishing, where attackers mimic legitimate platforms to exploit user trust and gain unauthorized access to accounts. Infrastructure analysis reveals the domain coeettrr.top was registered on December 12, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with malicious domains. The site resolves to IP address 103.108.41.18, hosted in Hong Kong under autonomous system AS135581 (ONL-HK). At the time of assessment, 19 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Google Safe Browsing explicitly labels it as phishing. The domain appears on one security blocklist and is actively blocked by enterprise phishing detection systems. Notably, the site lacks an SSL certificate, increasing the likelihood of interception during credential transmission. Organizations and users are advised to implement immediate mitigation measures to counter this threat. Network-level blocking of the domain coeettrr.top and its associated IP 103.108.41.18 should be enforced at firewalls and DNS resolvers. Security teams should monitor for indicators of compromise, including failed login attempts from internal IPs to the phishing domain or its IP. End-users should be educated on recognizing cryptocurrency phishing tactics, particularly those impersonating Coinbase, and instructed to verify domain authenticity before entering credentials. Multi-factor authentication should be mandated for all cryptocurrency exchange accounts to mitigate the impact of credential theft.