reconnecttnexa[.]xyz

This domain is flagged as a high-risk brand impersonation threat targeting Coinbase users through a fraudulent Wallet Connect interface. The site is designed to harvest cryptocurrency wallet credentials, seed phrases, or authentication tokens by mimicking legitimate Coinbase authentication flows. Analysis indicates the domain poses a direct risk to users attempting to connect wallets or log into Coinbase services via third-party integrations. Infrastructure analysis reveals the domain reconnecttnexa.xyz was registered on February 21, 2026, through HOSTINGER operations, UAB, and resolves to the IPv6 address 2a02:4780:b:1364:0:1245:6359:2, hosted on AS47583 (Hostinger International Limited) in the United States. The domain lacks an SSL certificate, increasing exposure to man-in-the-middle interception. It appears on three security blocklists and is flagged by 17 out of 95 security vendors on VirusTotal, including PhishDestroy, MetaMask, and SEAL. The page title, Wallet Connect, aligns with phishing tactics targeting cryptocurrency users seeking to link wallets to exchange platforms. The domain is currently offline, but historical activity suggests it was operational long enough to capture sensitive user data. Mitigation requires immediate action from security teams and end users. Network-level blocking should be implemented for the domain and its associated IP address. Cryptocurrency platforms and wallet providers should update their threat intelligence feeds to include this domain and its indicators of compromise. Users who may have interacted with the site should revoke any connected wallet permissions, rotate credentials, and monitor accounts for unauthorized transactions. Organizations should conduct retrospective log analysis to identify potential exposure and enforce multi-factor authentication for all cryptocurrency-related services. Given the domain's registration date in the future (2026), further scrutiny of the registrar's abuse handling is warranted.