coinbasez[.]st

PhishDestroy first observed coinbasez.st on Mar 26, 2026. The hostname explicitly references Coinbase; stored content metadata identifies the same apparent target. The captured page title is “Best Crypto Wallet for Web3, NFTs and DeFi | Trust”. Stored page analysis classifies the content as brand impersonation. Current evidence score: 65/100 (high).

Positive findings are stored from 3 sources: VirusTotal, DNS security resolvers, and URLQuery. VirusTotal recorded 1 detections among 94 engines: SOCRadar on Jul 18, 2026 at 18:45 UTC. DNS security checks returned 3 blocking results across 12 tested policies: Brand Base, Brand Coinbase, Quad9 Secure; no observation timestamp was retained. URLQuery recorded 2 threat-system alerts on Mar 26, 2026 at 01:58 UTC. Non-positive and contextual checks: The external blocklist snapshot contained no matches on Aug 8, 2026 at 02:20 UTC. On Mar 26, 2026 at 00:40 UTC, Google Safe Browsing returned no flag; PhishStats returned no feed match. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 02:47 UTC.

The collector marked the hostname reachable on Aug 7, 2026 at 22:14 UTC, but did not retain the HTTP response code. Registration records for the domain list Gname as the registrar and Mar 25, 2026 as the creation date. Registration and first observation occurred on the same UTC date. At collection time, the hostname resolved to 104.21.56.147 on AS13335 (Cloudflare, Inc.). The IP and ASN identify shared Cloudflare edge infrastructure; the origin server is not established by this address. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and URLQuery. IoC extraction on Jul 29, 2026 at 02:17 UTC retained 0 format-validated wallet addresses and 1 Telegram indicator. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Jun 23, 2026; checked Mar 26, 2026 at 13:58 UTC.

The content indicators and 3 positive source findings support the current Coinbase-themed brand impersonation classification.