coin[.]base-supports[.]com

Analysis of coin.base-supports.com, observed on July 23, 2026, identifies a brand‑impersonation campaign targeting Coinbase users. The domain was created on 11 August 2025 and registered through Global Domain Group LLC. DNS resolution points to the IPv4 address 198.251.81.188, which belongs to AS53667 (FranTech Solutions) located in the United States. The authoritative nameservers are ns17.asurahosting.com and ns18.asurahosting.com. No TLS certificate is presented, indicating the site was served over plain HTTP before being taken offline. The only page metadata collected is the title “Coinbase Support – 24/7 Customer Service | Buy and Sell Cryptocurrency,” which aligns with the declared brand target of Coinbase and the crypto‑scam classification.

Reputation metrics are extremely low: Gridinsoft assigns a trust score of 0 / 100, while Scamadviser rates the domain at 1 / 100. VirusTotal reports 12 positive detections from 95 scanning engines, confirming malicious intent. The domain appears on one external security blocklist and has been blocked by PhishDestroy. Current status is offline, and no additional payload or credential‑harvesting page details have been captured.

Defenders should immediately blacklist the domain and its resolving IP address, enforce blocking of the associated ASN, and add the nameserver pair to internal watchlists. Monitoring for newly‑registered subdomains that use the same registrar or hosting infrastructure is advised, as the same threat actor may reuse similar patterns. Because the site lacks HTTPS, any future re‑hosting would be detectable through missing certificate fingerprints. Continuous review of VirusTotal and other vendor feeds for updated detections is recommended to maintain situational awareness.