mojd[.]art

This domain, mojd.art, was observed hosting a Coinbase‑impersonation page titled “Wallet Verification”. The site was registered on April 01 2025 through Dynadot LLC and resolves to IP 186.2.166.73, which belongs to AS59692 (IQWeb FZ‑LLC) in the United Arab Emirates. No TLS certificate is presented, and the HTTP service is currently offline. Reputation checks show a Gridinsoft trust score of 0 / 100 and the domain appears on one security blocklist; it has also been blocked by PhishDestroy.

VirusTotal reports that 12 of 95 scanning engines flag the domain as malicious, reinforcing the suspicion of a wallet/seed phishing operation. The page title and the explicit “Coinbase” impersonation indicate that the attacker likely attempts to harvest cryptocurrency wallet credentials or seed phrases. The infrastructure uses CloudNS nameservers (pns41‑pns44.cloudns.net), a common pattern among disposable phishing sites.

Uncertainty remains regarding the exact payload delivered when the site was active, as the service is now taken offline and no SSL/TLS handshake was recorded. Defenders should add mojd.art to URL filtering and DNS blocklists, monitor for other domains registered with Dynadot that resolve to the same IP range or share the CloudNS nameserver set, and enforce strict outbound controls on connections to the identified IP address. Continuous threat‑intel feeds should be consulted for any re‑use of the same hosting provider or ASN in future campaigns targeting Coinbase users.