ioqsmtp[.]eubluemong7-mb-paypal[.]coinbase-assists[.]com

This domain operates as a crypto wallet drainer under the guise of Coinbase support, targeting users through brand impersonation tactics. The subdomain ioqsmtp.eubluemong7-mb-paypal and primary domain coinbase-assists.com mimic legitimate Coinbase infrastructure, likely distributing malicious JavaScript designed to siphon cryptocurrency from connected wallets. Analysis of the page structure reveals hidden iframe injections and obfuscated scripts consistent with known wallet-draining malware families active in Q4 2024. Infrastructure analysis confirms elevated risk indicators: 10 of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on one security blocklist. The domain was registered on November 21, 2024, through Hosting Concepts B.V. d/b/a Registrar.eu, with an SSL certificate issued by Let's Encrypt (R13). It resolves to IP address 15.197.130.221, hosted on Amazon Web Services (AS16509), a common pattern observed in ephemeral phishing infrastructure. The creation date aligns with recent surges in Coinbase-themed phishing campaigns, suggesting coordinated deployment. Users who visited this domain should immediately revoke any wallet permissions granted to coinbase-assists.com or associated subdomains. Check browser extensions for unauthorized additions and run a full system scan using updated endpoint detection tools. If cryptocurrency transactions were initiated, monitor wallet addresses for unauthorized transfers and report to relevant blockchain analysis platforms. Reset credentials for all financial accounts accessed from the same device or network, as the domain likely harvested additional sensitive data through keylogging or form-grabbing techniques.