coindcxba[.]com

This domain, coindcxba.com, is identified as a phishing infrastructure impersonating the cryptocurrency exchange Coindcx. Analysis indicates the threat type is a fake login page designed to harvest user credentials, potentially leading to unauthorized access to crypto wallets or funds. The page title explicitly mimics the legitimate exchange, suggesting an intent to deceive users into entering sensitive information. No specific drainer kit signatures were observed in initial scans, but the domain aligns with common credential-theft tactics used in crypto phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain was registered on March 09, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with malicious registrations. It resolves to the IP address 147.92.33.39, which has no prior history of legitimate hosting. VirusTotal detection shows 4 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists, including MetaMask and PhishDestroy, and is assigned a trust score of 0/100 by Gridinsoft. Technologies detected include Nginx, HSTS, and HTTP/3, which may be leveraged to enhance the appearance of legitimacy or evade basic detection mechanisms. As of the latest assessment, coindcxba.com has been taken offline, likely due to hosting provider intervention or registrar enforcement. However, the infrastructure remains a residual risk, as threat actors may re-deploy the domain or migrate to newly registered lookalike domains. Users who interacted with the site are advised to revoke any active sessions, reset credentials, and monitor linked accounts for unauthorized transactions. Organizations should update blocklists to include the domain and associated IP, while security teams should investigate potential lateral movement or secondary infections originating from this campaign.