us726262-coinbase[.]com

The domain us726262-coinbase.com has been identified as a brand impersonation phishing resource targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates the domain was designed to deceive users by mimicking the legitimate Coinbase interface, likely to harvest credentials or facilitate unauthorized transactions. As of the latest assessment, the domain has been taken offline, though prior activity suggests it was actively used in a phishing campaign prior to its deactivation. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on November 24, 2025, and resolved to the IP address 172.67.140.176, hosted under AS13335 (Cloudflare, Inc.). The domain lacks an SSL certificate, a common red flag for phishing resources. Detection metrics indicate it was flagged by 17 of 95 security vendors on VirusTotal, while appearing on a single security blocklist. The page title, 'Checking the security of your connection,' further suggests an attempt to mimic legitimate security verification processes to lower user suspicion. Current status confirms the domain is offline, reducing immediate risk to users. However, the infrastructure and registration details warrant continued monitoring for potential resurgence. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to include this indicator of compromise. Users who may have interacted with the domain should reset credentials associated with Coinbase or other financial services and enable multi-factor authentication where available. Security teams should review logs for connections to 172.67.140.176 and the domain itself to identify potential exposure.