mysafe-coinbase[.]com

Analysis of mysafe-coinbase.com indicates a newly registered domain created on February 24, 2026 that is being used to impersonate Coinbase in a crypto‑related scam. The domain resolves to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Registration was performed through NiceNIC International Group Co., Limited, and the authoritative name servers listed are ariadne.ns.cloudflare.com and ryan.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. No TLS certificate was observed, meaning the site is served over plain HTTP, which further reduces the credibility of any login page it may host.

The page title returned by the server is "Sign in," matching the brand‑targeted credential‑harvesting pattern commonly employed against Coinbase users. VirusTotal scanning recorded two positive detections out of ninety‑five security vendors, providing limited but concrete corroboration of malicious intent. The domain appears on three independent blocklists—PhishDestroy, MetaMask, and SEAL—demonstrating that multiple anti‑phishing services have flagged it.

Current operational status is offline, and the domain has been taken down, but the infrastructure details remain useful for attribution and for detecting any re‑deployment of similar assets. Defenders should block outbound connections to 188.114.97.3 at the network perimeter, add mysafe-coinbase.com to internal URL filtering and email security policies, and monitor for any new domains registered by the same registrar that employ Cloudflare name servers and lack TLS. Continuous observation of the listed blocklists is advised, as the actors may recreate the campaign using new domains that share the same registration and hosting characteristics.