knkabsc[.]wang

This domain, knkabsc.wang, is identified as a high-risk phishing resource specializing in brand impersonation targeting Coinbase, a major cryptocurrency exchange platform. Analysis indicates the site is designed to mimic the legitimate Coinbase interface, as evidenced by the page title 'Coinbase,' with the objective of credential harvesting and unauthorized access to user accounts. No evidence of a drainer kit or wallet-draining scripts was observed in initial scans, though further forensic analysis of cached content may be required to confirm this absence. The domain poses a significant threat to users unfamiliar with phishing tactics, particularly those engaging in cryptocurrency transactions. Infrastructure analysis reveals several critical technical indicators. The domain was registered on January 06, 2026, through Dominet (HK) Limited, a registrar frequently associated with malicious domains. It resolves to the IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.), a network commonly exploited for bulletproof hosting due to its resilience and privacy features. Google Safe Browsing has flagged the domain as phishing, and it appears on three independent security blocklists, including high-confidence threat intelligence feeds. VirusTotal reports a detection rate of 18 out of 95 security vendors, indicating moderate consensus on its malicious nature. Notably, the domain lacks an SSL certificate, a red flag for users accustomed to secure connections on financial platforms. As of the latest assessment, knkabsc.wang has been taken offline, likely due to enforcement actions by hosting providers or domain registrars. However, the residual risk remains elevated due to the potential for rapid redeployment under a new domain or IP address. Users who may have interacted with this domain are advised to immediately revoke any active sessions, reset credentials, and enable multi-factor authentication on their accounts. Organizations are encouraged to update their threat intelligence feeds to include this domain and its associated indicators, such as the IP address 188.114.97.3 and registrar details, to prevent future exposure. Continuous monitoring of newly registered domains impersonating financial services is recommended to mitigate similar threats.