login[.]coin-base[.]com

login.coin-base.com was registered through GoDaddy.com, LLC on March 03, 2026. The domain resolves to the IPv4 address 34.44.95.9, which belongs to Google LLC (AS396982) and is hosted in the United States. An SSL certificate issued by Let’s Encrypt (R12) is present, but the site currently returns HTTP 404 and is reported as taken offline. The page title observed during scanning reads “Coinbase - Buy and Sell Bitcoin, Ethereum, and more with trust”, matching the official Coinbase branding and confirming that the domain is attempting to impersonate the cryptocurrency exchange.

Automated analysis by Gridinsoft assigns a trust score of 0 out of 100, indicating extreme malicious confidence. The domain is listed on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans show five of ninety‑four security vendors flagging the domain as malicious. Technical fingerprinting reveals use of Contentful, Google Sign‑in, PayPal, Amazon Web Services, Onfido, OneTrust, LinkedIn Ads, and HSTS, all of which are common components in credential‑harvesting kits targeting crypto users.

The authoritative nameservers are ns1.adtraks.com and ns2.adtraks.com, which are not associated with the legitimate Coinbase infrastructure. While the exact phishing page content has not been captured, the combination of brand‑aligned page title, low trust score, blocklist presence, and the “Crypto Scam” classification strongly suggests a credential‑stealing or fund‑diversion campaign aimed at Coinbase customers. Defenders should add the domain and its IP address to inbound and outbound filtering rules, monitor for any authentication attempts to Coinbase services originating from this host, and ensure that users are educated about the legitimate Coinbase URL structure. Because the site is presently offline, continued observation of DNS changes and re‑activation attempts is advised.