cguige[.]d3skgp3um4jcuk[.]amplifyapp[.]com

Analysis dated July 24, 2026 indicates that the subdomain cguige.d3skgp3um4jcuk.amplifyapp.com was used to host a counterfeit Coinbase Wallet download page. The page title captured by crawlers reads “Download Coinbase Wallet - Official Website”, directly referencing the Coinbase brand. The domain resolves to the IPv4 address 3.171.214.25, which is allocated to Amazon.com, Inc. under AS16509 and geolocated to Germany. Nameserver records list ns-1165.awsdns-17.org, ns-1683.awsdns-18.co.uk, ns-169.awsdns-21.com and ns-904.awsdns, confirming use of Amazon Route 53 DNS infrastructure. Registration data shows the domain was created on April 17, 2018 and was registered through NOM‑IQ Ltd dba Com Laude.

No TLS certificate was presented, leaving the site exposed to plain‑HTTP connections. Google Safe Browsing flags the URL for social engineering twice, and the site has been added to a single external blocklist. PhishDestroy has already taken the site offline, and Gridinsoft assigns a trust score of 0 out of 100. VirusTotal reports that fifteen of ninety‑five scanned engines flagged the domain as malicious, reinforcing the classification as a high‑risk crypto‑related impersonation campaign. The combination of brand impersonation, lack of encryption, low trust score, and multiple vendor detections suggests a coordinated effort to lure Coinbase users into downloading malicious software.

Defenders should block the IP address 3.171.214.25 and the full subdomain in perimeter firewalls and DNS filtering solutions. Continuous monitoring of Amazon‑hosted infrastructure for similarly crafted subdomains is recommended, as the attacker appears to leverage cloud services for rapid deployment. Updating endpoint security with the latest indicators of compromise, including the domain name, IP, and associated Safe Browsing identifiers, will help mitigate exposure.