crypto-point[.]com

This domain, crypto-point.com, is identified as a brand impersonation threat targeting Coinbase, a major cryptocurrency exchange platform. The site presents itself as a legitimate Coinbase login portal, as indicated by the page title 'Coinbase' and its design likely intended to deceive users into entering credentials or sensitive financial information. No specific drainer kit signatures have been confirmed, but the infrastructure aligns with credential harvesting operations commonly observed in cryptocurrency-related phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 19 out of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It was registered through Gname.com Pte. Ltd. on October 03, 2016, though recent malicious activity suggests potential domain repurposing. The domain resolves to the IP address 172.67.162.41, hosted by Cloudflare, Inc. in Canada, a common tactic to obscure the true origin of phishing infrastructure. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1), a legitimate provider often exploited by threat actors to lend false credibility. No Google Safe Browsing (GSB) block status is explicitly noted, but the combination of detection metrics and blocklist presence underscores its malicious nature. As of the latest assessment, crypto-point.com has been taken offline, reducing immediate risk to users. However, the domain remains registered and could be reactivated or repurposed for future campaigns. Users who may have interacted with the site are advised to reset credentials, enable multi-factor authentication, and monitor financial accounts for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP address. The elevated risk level persists due to the domain's history and the potential for re-emergence, necessitating continued vigilance in monitoring related infrastructure.