xsgrkfow[.]trendyolal31[.]coinbase-assists[.]com

This domain, xsgrkfow.trendyolal31.coinbase-assists.com, is identified as a brand impersonation threat targeting Coinbase users. Analysis indicates the infrastructure is designed to mimic legitimate Coinbase support pages, likely to harvest cryptocurrency wallet credentials or distribute malicious payloads under the guise of official assistance. The page title, coinbase-assists.com, reinforces the deception by closely resembling authentic Coinbase domains, increasing the likelihood of user engagement with fraudulent content.

Evidence supporting the malicious classification includes detection by 12 out of 95 security vendors on VirusTotal, registration through Hosting Concepts B.V. d/b/a Registrar.eu on November 21, 2024, and resolution to IP 15.197.130.221 hosted on Amazon.com, Inc. (AS16509). The domain appears on one security blocklist, and its SSL certificate, issued by Let's Encrypt (R13), does not mitigate the risk due to the short-lived nature of such certificates. Infrastructure analysis reveals the domain was recently created, a common tactic to evade reputation-based defenses.

Users who visited xsgrkfow.trendyolal31.coinbase-assists.com should immediately revoke any active sessions linked to cryptocurrency wallets or exchanges. If credentials were entered, they must be changed from a secure device, and multi-factor authentication should be enabled where available. Monitor financial accounts for unauthorized transactions and report any suspicious activity to the targeted platform. Devices used to access the domain should undergo a full malware scan to detect potential secondary infections.