blocknode[.]ix[.]tc

This domain, blocknode.ix.tc, is identified as a brand impersonation threat targeting Coinbase, a major cryptocurrency exchange platform. The site is currently offline, but prior analysis confirms its malicious intent to deceive users into disclosing sensitive credentials or transferring digital assets under false pretenses. The impersonation includes an exact replica of the legitimate Coinbase page title, 'Coinbase - Buy and Sell Bitcoin, Ethereum, and more with trust,' to enhance credibility and trick victims. Analysis indicates the domain was registered through NICTC on March 19, 2007, though its malicious use appears to be recent. Infrastructure analysis reveals it resolves to the IP address 45.84.207.225. Detection metrics show the domain is flagged by 9 of 95 security vendors on VirusTotal, and it appears on two independent security blocklists. The domain has been explicitly blocked by PhishDestroy and ScamSniffer, further corroborating its malicious classification. The combination of brand impersonation tactics and low detection thresholds among major security engines underscores the elevated risk associated with this infrastructure. As of the latest assessment, blocknode.ix.tc has been taken offline, likely due to enforcement actions or infrastructure changes. However, users who may have interacted with the domain prior to its deactivation should immediately revoke any active sessions, reset credentials, and monitor financial accounts for unauthorized transactions. Organizations are advised to update web filtering rules to block the domain and its associated IP address. Proactive monitoring of newly registered domains with similar naming patterns or infrastructure is recommended to mitigate future threats of this nature.