vxeqptds[.]trendyolal31[.]coinbase-assists[.]com

The domain vxeqptds.trendyolal31.coinbase-assists.com was registered on 21 November 2024 through Hosting Concepts B.V. d/b/a Registrar.eu and resolves to the Amazon Web Services IP address 15.197.130.221 (AS16509, United States). HTTP requests to the server returned a page whose title is "coinbase-assists.com", indicating an attempt to masquerade as a Coinbase‑related service. The web server stack consists of Nginx with the OpenResty module, and the site was protected by a Let’s Encrypt R13 TLS certificate, confirming the use of standard automated certificate issuance. The domain appears on one public security blocklist and is actively blocked by PhishDestroy.

VirusTotal scans recorded 14 detections out of 95 security vendors, suggesting that multiple scanners flagged the site as malicious. Additionally, Gridinsoft assigned a trust score of 0 out of 100, reinforcing the assessment of high risk. The nameserver configuration includes ina1.registrar.eu, ina2.registrar.eu, ina3.registrar.eu, ns1.openprovider.nl, and ns2.op, reflecting a multi‑provider DNS setup that may be used to increase resilience. The listed scam type is "Crypto Scam" and the domain explicitly impersonates Coinbase, targeting users of the cryptocurrency exchange.

Current observations indicate that the site is offline, so active exploitation cannot be confirmed at this time. However, the combination of brand impersonation, low trust score, multiple vendor detections, and presence on a blocklist warrants elevated risk classification. Defenders should continue to block the domain at network perimeter devices, monitor DNS queries for the listed nameservers, and watch for any re‑hosting of the same content on alternative IPs or subdomains. Incident response teams should also consider reviewing any recent user reports of unsolicited Coinbase‑related communications that could have referenced this URL, as the offline status does not preclude prior victimization.