lionsgateinvestment[.]trade

This domain is flagged as a high-risk brand impersonation threat designed to exploit users of Coinbase, a major cryptocurrency exchange platform. Analysis indicates the site employs deceptive design elements to replicate Coinbase’s official interface, likely aiming to harvest credentials, private keys, or facilitate unauthorized transactions. The threat type is classified as brand impersonation with potential secondary objectives such as credential theft or crypto asset diversion, based on historical patterns associated with similar domains. Infrastructure analysis reveals the domain lionsgateinvestment.trade was registered on March 24, 2025, through NameSilo, LLC, a registrar frequently observed in phishing campaigns. It resolves to the IPv6 address 2a02:4780:b:968:0:34ca:fd83:10, hosted under AS47583 (Hostinger International Limited) in the United States. The domain lacks an SSL certificate, increasing the likelihood of interception or manipulation of user data in transit. Security vendors on VirusTotal flagged the domain at a ratio of 17/95, while it appears on three independent security blocklists. Additional detection sources include PhishDestroy, MetaMask, and SEAL, all of which have classified this domain as malicious. Google Safe Browsing also designates it as a phishing threat, corroborating the high-risk assessment. Mitigation requires immediate action from both end users and security teams. Users who accessed the domain should revoke any active sessions on Coinbase, rotate passwords, and enable multi-factor authentication (MFA) using non-SMS-based methods. Cryptocurrency wallet holders should verify no unauthorized transactions occurred and consider transferring assets to a new wallet if exposure is suspected. Security teams should add the domain and its resolving IP address to blocklists at the DNS and network perimeter levels. Additionally, monitoring for domains registered under the same registrar or hosting provider with similar naming conventions (e.g., combining financial terms with brand names) can help preemptively identify related threats. Organizations should also educate users on recognizing brand impersonation tactics, such as scrutinizing domain names for misspellings, checking for SSL certificates, and verifying official communication channels before entering sensitive information.