ftp[.]coinbaseregion[.]com

The domain ftp.coinbaseregion.com is a phishing site engaged in brand impersonation targeting Coinbase users. It poses an elevated risk as a cryptocurrency scam designed to deceive victims into disclosing login credentials or sensitive information, though no drainer kit was identified. As of the latest verification, ftp.coinbaseregion.com has been taken offline, but prior activity suggests it was actively used for fraudulent purposes.

Technical indicators confirm the domain's malicious nature. ftp.coinbaseregion.com was flagged by 1 of 95 VirusTotal security vendors, including SOCRadar, and appears on 1 security blocklist (PhishDestroy). Registered through Cosmotown, Inc. on February 21, 2026, the domain resolved to IP address 198.251.89.229, hosted by FranTech Solutions in the US (AS53667). No SSL certificate was available, and the observed page title was absent. Nameservers included ns111.asurahosting.com, ns111.my-control-panel.com, and ns112.asurahosting.com. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as a phishing threat.

Victims who interacted with ftp.coinbaseregion.com should immediately change their Coinbase passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious transactions or unauthorized logins, and report any fraudulent activity to Coinbase support. Additionally, consider reporting the domain to platforms like Google Safe Browsing, PhishTank, or local cybercrime authorities to aid in broader mitigation efforts.