verifyagent-zendsk[.]com

This domain, verifyagent-zendsk.com, is flagged as a high-risk brand impersonation phishing site targeting Coinbase users. Analysis indicates the threat actor designed the site to mimic legitimate Coinbase support pages, as evidenced by the page title 'Coinbase Help' and the use of modern web technologies to enhance credibility. The specific threat type involves credential harvesting and potential cryptocurrency theft through fraudulent support interactions. Infrastructure analysis reveals the domain was registered on April 22, 2026, through NAMECHEAP INC, a registrar frequently abused for malicious purposes. The domain resolves to the IP address 63.176.8.218 and appears on three security blocklists, including detection by MetaMask, PhishDestroy, and SEAL. VirusTotal reports 16 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. AlienVault OTX further corroborates the threat, listing the domain in eight distinct threat intelligence pulses. Technologies detected on the site include Node.js, React, Next.js, Netlify, HSTS, and Webpack, which are often leveraged to create convincing phishing interfaces. Mitigation against this type of brand impersonation phishing requires heightened user awareness and technical controls. Organizations should implement strict domain monitoring to detect newly registered domains mimicking their brand, particularly those using registrar services associated with malicious activity. End users should verify the legitimacy of support pages by cross-referencing URLs with official sources and avoiding interaction with unsolicited communications. Network-level protections, such as DNS filtering and real-time threat intelligence feeds, should be deployed to block access to confirmed malicious domains. Additionally, multi-factor authentication and hardware-based security keys can mitigate the impact of credential theft in the event of a successful phishing attempt.