qwe[.]zfxriwrtqr[.]my

This domain, qwe.zfxriwrtqr.my, operates as a credential-theft phishing site specifically targeting Coinbase users. Analysis of the page title, which explicitly displays 'Coinbase,' confirms the domain is designed to mimic the legitimate cryptocurrency exchange platform. The objective is to deceive users into entering sensitive account details, including usernames, passwords, and potentially two-factor authentication codes, which are then harvested by threat actors for unauthorized access or financial theft. The domain's infrastructure and lack of legitimate branding elements further support its classification as a malicious impersonation attempt. Evidence from technical indicators strengthens the assessment of this domain as a confirmed phishing threat. VirusTotal analysis reveals that 14 out of 95 security vendors have flagged qwe.zfxriwrtqr.my as malicious, indicating a consensus among multiple detection engines. The domain was registered on July 29, 2025, through NameSilo, LLC, a registrar frequently associated with recently created phishing domains. Infrastructure analysis shows the domain resolves to the IP address 45.119.98.238, hosted under AS133199 (SonderCloud Limited) in Hong Kong, a region commonly leveraged for bulletproof hosting. Additionally, the domain appears on one security blocklist and lacks an SSL certificate, a red flag for secure communication. The combination of these factors—rapid registration, absence of encryption, and low blocklist prevalence—suggests an opportunistic attack vector rather than a long-term campaign. Users who visited qwe.zfxriwrtqr.my should take immediate action to mitigate potential compromise. First, any credentials entered on the site must be considered exposed and should be changed immediately across all platforms where the same password was reused. Enable multi-factor authentication (MFA) on Coinbase and other financial accounts to add an additional layer of security. Monitor account activity for unauthorized transactions or login attempts, and report suspicious behavior to the targeted service provider. If personal or financial information was submitted, consider placing a fraud alert or credit freeze with relevant bureaus. Finally, ensure endpoint security tools are updated and perform a full system scan to detect any secondary payloads or malware that may have been delivered during the interaction with the phishing site.