wawwaw22[.]biz[.]id

This report details a malicious domain, wawwaw22.biz.id, that posed a significant cryptocurrency phishing threat. The site’s page title, “Login - Coinbase Style Pro,” indicates it was designed to impersonate the legitimate Coinbase brand. The threat posed was credential theft, as the site likely aimed to harvest login credentials from users attempting to access a fake cryptocurrency trading platform.

Technical analysis confirms the site’s malicious nature. VirusTotal flagged the domain with 9 detections out of 95 security vendors. Specific vendors including alphaMountain.ai, BitDefender, CRDF, ESET, and G-Data identified it as malicious. The domain is hosted on IP address 103.185.53.105, located in Indonesia, and is registered under the registrar IDNIC-PTAMI-ID, associated with ASN 139456 (PT DEWAWEB). The SSL certificate was issued by GoGetSSL RSA DV CA. The nameservers are ns1.dewaweb.com, ns2.dewaweb.com, and ns3.dewaweb.com.

The domain is currently DOWN/OFFLINE, indicating the threat is no longer active. The overall risk level is assessed as HIGH due to the specific targeting of cryptocurrency users and the use of a recognized brand impersonation. The technical evidence, including the high number of security vendor detections and the domain’s registration details, supports this assessment.