coinbase-ledgerx[.]my

This domain, coinbase-ledgerx.my, is identified as a high-risk brand impersonation threat targeting Coinbase, a major cryptocurrency exchange platform. Analysis indicates the site mimics legitimate Coinbase services, likely to deceive users into disclosing sensitive credentials or transferring digital assets. The page title, 'Home,' suggests an attempt to replicate the appearance of the official Coinbase interface, a common tactic in credential harvesting or cryptocurrency drainer schemes. No explicit drainer kit signatures were observed in initial scans, but the domain's structure and branding align with known phishing methodologies. Infrastructure analysis reveals the domain was registered on December 02, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with malicious domains. It resolves to the IP address 154.210.2.11, hosted under AS400619 (AROSSCLOUD INC.) in Hong Kong. VirusTotal detection metrics show 21 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing explicitly classifies it as a phishing threat. The domain appears on one security blocklist, and its SSL certificate, issued by Let's Encrypt (R13), does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. As of the latest assessment, coinbase-ledgerx.my has been taken offline, reducing immediate exposure to users. However, the domain's infrastructure remains a latent risk, as threat actors may reactivate it or repurpose the hosting environment for future campaigns. Organizations and individuals are advised to monitor for residual DNS records, block the IP address 154.210.2.11 at the network level, and update endpoint protection rules to include this domain and its associated indicators. Users who may have interacted with the site should revoke any active sessions, rotate credentials, and verify account integrity through official channels.