aid[.]hgurehxhig[.]my

PhishDestroy has identified a high-risk threat involving the domain aid.hgurehxhig.my, which is engaged in brand impersonation targeting Coinbase. This domain was designed to deceive users into believing they are accessing a legitimate Coinbase platform, but in reality, it functions as a crypto drainer aimed at stealing digital assets. The current status of the domain is offline, but its recent activity warrants attention due to the sophisticated nature of the impersonation.

Technical analysis reveals several concerning indicators. The domain was registered through NameSilo, LLC on July 29, 2025, and resolves to IP address 45.204.218.213. It appears on two security blocklists and is flagged by Google Safe Browsing as phishing. Importantly, VirusTotal reports 14 out of 95 security vendors flagging this domain as malicious. The page title found was simply "Coinbase," and the domain lacks an SSL certificate, further indicating its fraudulent nature.

To protect against such threats, users should always verify the authenticity of any Coinbase-related website by directly typing the official URL into their browser rather than clicking on links from emails or messages. Additionally, enabling two-factor authentication on all crypto accounts adds an extra layer of security. If you encounter a similar domain, report it immediately to PhishDestroy and avoid entering any personal information or credentials on suspicious sites. Stay vigilant and double-check URLs before engaging with any crypto platform.