qwe[.]hjtvwfksrc[.]my

This report details a malicious domain identified as qwe.hjtvwfksrc.my. The site's page title was "Coinbase," and it was designed to impersonate the Coinbase brand as part of a cryptocurrency scam. The primary threat posed by this site is phishing, aiming to trick users into revealing sensitive financial information or cryptocurrency credentials by mimicking a legitimate exchange platform.

Technical evidence confirms the site's malicious nature. VirusTotal flagged it with 14 detections out of 95 security vendors, including ADMINUSLabs, BitDefender, CyRadar, ESET, and Forcepoint ThreatSeeker. The domain was registered through NameSilo, LLC and created on July 29, 2025. It resolved to IP address 45.119.98.238, hosted in Hong Kong under AS133199 SonderCloud Limited. The site lacked SSL encryption and utilized nameservers becky.ns.cloudflare.com and conrad.ns.cloudflare.com.

The domain is currently offline and inaccessible. Risk assessment tools indicate a very high threat level, with a GridinSoft trust score of 0 out of 100 and a DOM risk score of 10. It is also listed on one blocklist. Based on the available data, this domain represents a confirmed, high-risk cryptocurrency phishing threat.