9230541-coinbase[.]com

This domain, 9230541-coinbase.com, is identified as a high-risk brand impersonation threat targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates the domain was designed to deceive users into disclosing sensitive credentials or authorizing fraudulent transactions, likely through a wallet-draining mechanism. The page title, matching the domain name, reinforces the illusion of legitimacy while exploiting the Coinbase brand to lower user vigilance. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Hello Internet Corp, a registrar frequently associated with malicious activity. It currently resolves to the loopback IP address 127.0.0.1, suggesting either a sinkholing measure or a temporary offline state. Detection metrics include a VirusTotal score of 14/95 security vendors flagging the domain as malicious, while Google Safe Browsing explicitly classifies it as phishing. The domain appears on three independent security blocklists, further corroborating its malicious intent. The SSL certificate is issued under the identifier PhishDestroy / botadmin.destroy.tools, a known indicator of phishing infrastructure. As of the latest assessment, 9230541-coinbase.com has been taken offline, likely due to enforcement actions by security providers such as PhishDestroy, MetaMask, and SEAL. Despite its inactive status, the domain remains a residual risk due to potential re-registration or reactivation. Organizations and users are advised to maintain blocklist updates and monitor for related domains leveraging similar naming conventions or SSL certificate patterns. Proactive measures, including DNS filtering and endpoint protection rules, are recommended to mitigate exposure to this and derivative threats.