edsajkdfdsq[.]top

The domain edsajkdfdsq.top is identified as a brand-impersonation threat targeting Coinbase, a cryptocurrency exchange platform. Analysis confirms this domain was designed to mimic the official Coinbase login interface, as evidenced by the page title 'Coinbase' and its classification under brand_impersonation. The domain is currently offline, though prior activity indicates it was actively used in phishing operations. Infrastructure analysis reveals the domain was registered on November 20, 2025, through Gname.com Pte. Ltd. It resolves to the IP address 112.213.124.71, hosted under AS152194 (CTG Server Limited) in Hong Kong. Security vendor assessments on VirusTotal flagged the domain as malicious, with 19 of 95 engines detecting it. The domain appears on two security blocklists and is explicitly blocked by at least two threat intelligence feeds. No SSL certificate was present, increasing the likelihood of interception or manipulation of transmitted credentials. The domain’s current offline status suggests mitigation efforts may have been successful, though its prior use in credential harvesting warrants continued monitoring. Organizations and users are advised to block the domain and its associated IP (112.213.124.71) at the network level. Security teams should review logs for connections to the domain or IP, particularly from endpoints that may have interacted with cryptocurrency-related services. Users who accessed the domain should assume credential compromise and initiate password resets for Coinbase and any reused credentials. Additionally, domain registrars and hosting providers are encouraged to review registration patterns associated with Gname.com Pte. Ltd. for similar malicious activity.