ww6[.]coinbasekyc[.]reqauest-updateaccount[.]info

Analysis of ww6.coinbasekyc.reqauest-updateaccount.info confirms it as a phishing domain targeting Coinbase users, classified as a crypto scam. The domain was registered through AMAZO-4 (ASN 16509) and resolved to IP 75.2.18.233, hosted on Amazon.com, Inc. infrastructure in the US. No SSL certificate was detected, increasing the risk of unencrypted credential interception. The page title, 'reqauest-updateaccount.info,' suggests an attempt to mimic account verification processes, though the exact content remains unanalyzed.

Detection by 13 of 95 security vendors on VirusTotal and inclusion on one security blocklist further validate its malicious classification. Gridinsoft assigned a trust score of 0/100, reinforcing its high-risk status. The domain was taken offline following detection, but defenders should treat any residual DNS records or cached pages as compromised. Infrastructure analysis reveals the use of Amazon's cloud services, a common tactic for rapid deployment and evasion.

While the specific phishing kit or payload is not identified, the domain's structure and naming convention align with known Coinbase impersonation campaigns. No Safe Browsing or OTX data is available for cross-verification. Organizations should block the domain, IP, and associated ASN ranges, monitor for credential reuse, and alert users to the threat.