knkabsc[.]top

The domain knkabsc.top was registered on February 21, 2026 and is currently taken offline. Infrastructure analysis shows it resolves to 172.67.168.200, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The site presented a page title of "Coinbase" and is classified as a crypto‑related scam that impersonates the Coinbase brand. Security telemetry indicates that the domain is listed on at least one public blocklist and has been actively blocked by PhishDestroy. The SSL certificate in use is identified as WE1, confirming the presence of HTTPS without further validation of the certificate authority.

Threat intelligence from AlienVault OTX references the domain in two separate pulses, reinforcing its association with malicious activity. Gridinsoft assigned a trust score of zero out of one hundred, reflecting extreme suspicion. VirusTotal analysis recorded detections from 19 of 95 scanning engines, providing independent corroboration of malicious behavior. The available data do not reveal the exact content served before the takedown, nor any details about the phishing kit or payload.

Consequently, uncertainty remains regarding the specific mechanisms used to lure victims. Defenders should continue to block the domain at network perimeters, monitor DNS queries for the associated IP address, and ensure that any endpoint security solutions incorporate the latest blocklist entries. Organizations that use Coinbase services should alert users to the existence of this impersonation attempt and reinforce credential‑security practices. Ongoing surveillance of Cloudflare‑hosted IPs linked to fraudulent domains is recommended to detect future campaigns that may reuse the same infrastructure.