coinbaza[.]pl

This domain, coinbaza.pl, is an active phishing domain posing as a fake cryptocurrency exchange. Registered on May 21, 2026, through Aftermarket.pl Limited, it resolves to IP address 185.253.212.22, hosted in Poland by Michau Enterprises Limited. The SSL certificate is issued by AfterMarket.pl and uses the identifier banned.ssl.vhost. Analysis indicates a high-risk threat: the domain is flagged by 13 of 91 security vendors on VirusTotal and appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. AlienVault OTX includes it in one threat intelligence pulse. The HTTP status is 200, and the Gridinsoft trust score is 0/100. Defenders should block this domain at the network and email gateway levels, as it is confirmed active and used for credential harvesting or financial fraud. The exact brand impersonated is not specified beyond a fake exchange; however, given the domain name coinbaza.pl, it likely targets users of cryptocurrency trading platforms. No additional page content or tracking infrastructure details are available from the provided intelligence. Defenders should monitor for related domains registered through the same registrar or hosted on the same IP range. Immediate action includes adding the domain to DNS blocklists and alerting users to avoid interaction.