cwsrmveq[.]coinbase-assists[.]com

This domain, cwsrmveq.coinbase-assists.com, is flagged as a brand impersonation threat targeting Coinbase users. Analysis indicates the site is designed to harvest login credentials and sensitive financial information by mimicking Coinbase’s official support infrastructure. The page title, coinbase-assists.com, reinforces the deception by closely resembling legitimate Coinbase service domains. No specific drainer kit signatures have been identified, but the domain’s structure and content align with typical credential-phishing campaigns observed in the cryptocurrency sector.

Technical indicators confirm the domain’s malicious nature. It was registered on November 21, 2024, through Hosting Concepts B.V. d/b/a Registrar.eu and resolves to IP address 15.197.130.221, hosted on Amazon.com, Inc. (AS16509). VirusTotal reports 9 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist and is actively blocked by PhishDestroy. The SSL certificate, issued by Let’s Encrypt (R12), provides a false sense of security to potential victims.

As of the latest assessment, cwsrmveq.coinbase-assists.com has been taken offline, likely due to hosting provider intervention or registrar enforcement. However, the infrastructure remains a residual risk. Adversaries may re-deploy the domain or migrate to similar impersonation domains using the same registrar or hosting provider. Users who interacted with the site should assume credential compromise and initiate password resets, multi-factor authentication reviews, and account activity audits. Organizations should monitor for related domains registered through the same registrar or resolving to the same IP range.