batsedgx[.]vip

This domain is flagged for elevated-risk brand impersonation targeting CoinMarketCap, a prominent cryptocurrency data platform. The threat involves presenting a deceptive interface mimicking the legitimate site to manipulate users into disclosing sensitive information or interacting with malicious smart contracts, likely for cryptocurrency theft or fraudulent token distribution. Analysis indicates a deliberate attempt to exploit trust in the CoinMarketCap brand to conduct financial fraud under the guise of legitimate crypto services. Infrastructure analysis reveals the domain batsedgx.vip was registered on May 04, 2024, through Gname.com Pte. Ltd. It resolves to the IP address 104.21.88.108, hosted on Cloudflare’s network (AS13335). The domain appears on one security blocklist and is flagged by 14 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), and the page title observed was 'EDGX.' The domain has since been taken offline, though historical resolution and certificate data remain accessible for forensic analysis. Mitigation steps for this specific threat type include immediate blocking of the domain and associated IP (104.21.88.108) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate hash into endpoint detection and response (EDR) systems and security information and event management (SIEM) platforms. User awareness training should emphasize verification of domain authenticity before interacting with crypto-related platforms, particularly those soliciting wallet connections or personal data. Monitoring for similar domains registered through the same registrar or resolving to the same IP range may help identify related malicious infrastructure.