491852coinbase[.]com

491852coinbase.com was registered through NiceNIC International Group Co., Limited on 14 Oct 2025. The domain resolves to 104.18.35.15, an address owned by AS13335 Cloudflare, Inc. in the United States. DNS is served by holly.ns.cloudflare.com and sergi.ns.cloudflare.com. No SSL certificate is presented for the site, indicating that HTTPS was not configured at the time of analysis. The page title returned from the HTTP response is “Coinbase Deutschland – Sicherer Kauf und Verkauf von Bitcoin, Ethereum und mehr”, which directly references the Coinbase brand and suggests a crypto‑related offering.

VirusTotal records show that 7 of 95 scanned security vendors flagged the domain as malicious. The domain appears on a single public blocklist and is actively blocked by the PhishDestroy service. The threat is classified as a crypto scam that impersonates Coinbase. Current status is offline, and the domain has been taken down. Analysis indicates that the infrastructure leverages Cloudflare’s CDN, a common choice for fast‑flux or temporary phishing sites, while the lack of TLS and the recent registration date point to a short‑lived campaign.

The presence of a brand‑specific page title and the explicit “Coinbase Deutschland” wording confirm targeted brand impersonation rather than a generic crypto lure. Defenders should add 104.18.35.15 to network‑level deny lists, enforce blocking of the domain at DNS resolvers, and monitor for any re‑registration attempts. Continuous re‑scanning of the domain on VirusTotal and checking against emerging blocklists is advisable, as the low detection count suggests that some security products may not yet have signatures for this indicator. Organizations using Coinbase services should educate users about the absence of a valid SSL certificate and the risk of unsolicited URLs referencing “Coinbase Deutschland” that do not originate from official Coinbase infrastructure.