downnew[.]coinbaseai[.]bar

Analysis indicates that the domain downnew.coinbaseai.bar is currently offline but exhibits multiple indicators of a high‑risk brand‑impersonation operation targeting Coinbase users. The domain was registered on 30 May 2025 through Gname.com Pte. Ltd., and its authoritative name servers are vip7.alidns.com and vip8.alidns.com, both associated with Alibaba Cloud DNS services. DNS resolution points to the IPv4 address 47.237.7.12, which belongs to AS45102 (Alibaba (US) Technology Co., Ltd.) and is geolocated in Singapore. No TLS certificate was observed for the host, meaning any HTTP request would be delivered over unencrypted HTTP, a common characteristic of fast‑hosted phishing sites. Reputation services corroborate the malicious profile.

Scamadviser assigns a trust score of 1 / 100 and Gridinsoft rates the host at 0 / 100, both indicating extreme distrust. VirusTotal reports that ten of ninety‑five scanning engines flag the domain, confirming that at least a subset of security vendors have identified malicious behavior. The domain appears on one public blocklist and is listed by PhishDestroy as blocked, reinforcing its classification as a crypto‑related scam. The page title returned from the host is “Coinbase Pro”, directly referencing the targeted brand, and the intelligence tags the activity as a “Crypto Scam”.

Because the site is offline, active probing is limited, but defenders should still consider the associated IP address and name‑server infrastructure as potentially reusable for future campaigns. Recommendations include adding 47.237.7.12 to network‑level deny lists, monitoring DNS queries for vip7.alidns.com and vip8.alidns.com for any new subdomains referencing the Coinbase brand, and ensuring that endpoint protection solutions are updated with the latest indicators of compromise from the ten detecting vendors. Continuous observation of the registrar Gname.com Pte. Ltd. for new registrations that mimic financial brands is advised.