commerce[.]infopayments-coinbase[.]com

Analysis of commerce.infopayments-coinbase.com indicates a high‑risk brand‑impersonation campaign aimed at Coinbase users. The domain was registered on 2 May 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IPv4 address 45.11.59.229, which is advertised as belonging to AS43641 SOLLUTIUM EU Sp z.o.o. in the Netherlands. The authoritative name servers are ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org and ns4.timeweb.org. No TLS certificate is presented, meaning connections are unencrypted.

The page title returned by the server is the literal domain name, providing no additional context. VirusTotal scans show that ten of ninety‑five security vendors flagged the domain, and the site appears on a single external blocklist. Google Safe Browsing classifies it as a social‑engineering threat, and the anti‑phishing service PhishDestroy has already blocked it. The domain is currently listed as offline, but the underlying infrastructure remains observable. The evidence confirms a crypto‑scam vector that leverages the Coinbase brand to lure victims, yet the specific payload or credential‑capture mechanisms have not been publicly disclosed.

Defenders should incorporate the IPv4 address and the four timeweb name servers into network‑level deny lists, and ensure that any outbound connections to the domain are halted. Updating URL filtering solutions with the domain name and the associated Google Safe Browsing and PhishDestroy identifiers will reduce exposure. Continuous monitoring of SOLLUTIUM‑owned address space for similar patterns is advised, as the registrar and hosting provider have been used in prior campaigns. Threat‑intel sharing platforms should be notified of the detection counts and blocklist presence to improve community awareness.