recuperaresoldipersineltrading[.]com

This domain, recuperaresoldipersineltrading.com, was registered on May 31, 2024 through HOSTINGER operations, UAB. The authoritative name servers are coco.bunny.net, coco.gr-ns.com, kiki.bunny.net, and kiki.gr-ns.com, and the domain resolves to the IPv4 address 178.16.54.134, which is assigned to AS202412 Omegatech LTD located in the Netherlands. No TLS certificate is presented for the host, indicating that connections are made over plain HTTP. The site is currently listed as offline, and it has been removed from public access. Analysis of threat intelligence shows that the domain is used for brand impersonation targeting Apple, with the page title reported as “Coinbase – Sign in,” indicating a crypto‑related credential‑harvesting campaign.

The campaign is classified as a crypto scam. Detection services have flagged the domain: 14 of 95 security vendors on VirusTotal report a detection, the domain appears on one security blocklist, and it is blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, confirming a high level of malicious confidence. The domain is present on at least one blocklist, reinforcing its malicious status. Defenders should continue to block the domain at network perimeter devices and update URL filtering lists to include the four listed name servers and the associated IP address.

Because the site lacks an SSL certificate, any attempt to retrieve content will be over unencrypted HTTP, which can be detected by proxy logs. Monitoring for outbound connections to 178.16.54.134 and for HTTP requests containing the “Coinbase – Sign in” title can aid in early detection. Threat‑intelligence feeds should be refreshed to capture any re‑hosting attempts, as the infrastructure (Hostinger registrar and Bunny DNS) is commonly reused by other malicious actors.