knmfalgh[.]trendyolal31[.]coinbase-assists[.]com

This domain, knmfalgh.trendyolal31.coinbase-assists.com, is flagged as a brand impersonation threat specifically targeting Coinbase, a major cryptocurrency exchange platform. Analysis indicates the site was designed to deceive users into believing they are interacting with legitimate Coinbase support or account management services, likely aiming to harvest credentials or sensitive financial information. The page title, coinbase-assists.com, reinforces the deception by mimicking official Coinbase branding, a common tactic in phishing campaigns to establish false legitimacy. Infrastructure analysis reveals multiple technical indicators supporting the classification of this domain as malicious. The domain was registered on November 21, 2024, through Hosting Concepts B.V. d/b/a Registrar.eu and resolves to the IP address 15.197.130.221, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. Security vendor detections on VirusTotal report 13 out of 95 engines flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Let's Encrypt (R13), a detail often exploited by threat actors to lend a superficial layer of trust to fraudulent sites. As of the latest assessment, the domain has been taken offline, reducing immediate exposure to potential victims. However, the infrastructure remains a residual risk, particularly if the actors behind this campaign retain control of the hosting environment or associated IP ranges. Organizations and individuals are advised to monitor for related domains leveraging similar naming conventions or infrastructure, as threat actors frequently rotate domains to evade detection. Blocking the IP address 15.197.130.221 and implementing DNS-based filtering for the domain and its subdomains is recommended to mitigate further risk.