admin[.]coinbase-china[.]info

The domain admin.coinbase-china.info is identified as a brand impersonation threat targeting the cryptocurrency exchange Coinbase. The domain is currently offline, reducing the immediate risk to potential victims. However, the historical data and technical indicators suggest that this domain has been actively used in phishing campaigns.

Infrastructure analysis reveals that admin.coinbase-china.info was registered through Web Commerce Communications Limited dba WebNic.cc. The domain resolves to the IP address 54.179.238.221 and has been flagged by 21 of 95 VirusTotal security vendors, indicating a significant level of suspicion. The site was detected using technologies such as Bootstrap, Nginx, jQuery-pjax, and jQuery, and it has an HSTS policy in place. The domain appears on one security blocklist and has a Gridinsoft trust score of 0/100, reflecting a complete lack of trustworthiness. The page title found was '总后台', which translates to 'Main Backend' in English, further suggesting an attempt to impersonate a legitimate administrative interface.

Given the domain's current offline status, the immediate risk is mitigated. However, the domain has a history of being used in phishing activities, and the technical indicators and low trust scores emphasize the elevated risk level. Security teams and users are advised to monitor for any signs of the domain coming back online and to avoid interacting with any links or emails that direct to this domain. Additionally, it is recommended to configure firewalls and security software to block access to this domain and to educate users about the dangers of brand impersonation phishing attacks.