lqkcfyuw[.]trendyolal31[.]coinbase-assists[.]com

This domain, lqkcfyuw.trendyolal31.coinbase-assists.com, is flagged as a crypto scam impersonating Coinbase, with infrastructure analysis revealing multiple indicators of malicious intent. Registered on November 21, 2024, through Hosting Concepts B.V. d/b/a Registrar.eu, the domain resolves to IP address 15.197.130.221, hosted within Amazon.com, Inc.'s AS16509 network in the United States. The SSL certificate is issued for 'localhost,' a non-standard and suspicious configuration often associated with hastily deployed phishing or scam infrastructure. The page title, 'coinbase-assists.com,' directly references the targeted brand, reinforcing the impersonation attempt.

Detection data shows the domain appears on one security blocklist, and nine of 95 security vendors on VirusTotal have flagged it as malicious. Gridinsoft assigns a trust score of 0/100, further supporting its classification as high-risk. MX records point to mx156.hostedmxserver.com with a priority of 10, which may be used to facilitate fraudulent email communication or credential harvesting attempts. The domain's nameservers—ina1.registrar.eu, ina2.registrar.eu, ina3.registrar.eu, and ns1.openprovider.nl—are consistent with the registrar's infrastructure but provide no additional legitimacy.

As of July 24, 2026, the domain is offline, though its prior activity and infrastructure remain relevant for defensive measures. Defenders should treat this domain as a confirmed crypto scam impersonating Coinbase, block all resolutions at DNS and network levels, and monitor for any re-emergence or related domains using similar naming patterns or infrastructure. The combination of brand impersonation, low trust scores, and detection by multiple security vendors warrants elevated alert status for organizations handling cryptocurrency or financial services.