593251-coinbase[.]com

The domain 593251-coinbase.com was registered on 13 December 2025 through NiceNIC International Group Co., Limited and is currently listed as taken offline. DNS resolution points to the loopback address 127.0.0.127, and the authoritative nameservers are ns3.my-ndns.com and ns4.my-ndns.com. No SSL certificate is present, indicating that HTTPS connections are not supported. Google Safe Browsing flags the site for social engineering, and AlienVault OTX has referenced the domain in three separate threat‑intel pulses, reinforcing its association with malicious activity.

VirusTotal analysis shows that 19 of 95 security vendors have flagged the domain, and it appears on a single security blocklist. PhishDestroy has explicitly blocked the domain, and Gridinsoft assigns it a trust score of 0 out of 100, reflecting a high confidence of malicious intent. The listed scam type is a crypto scam, and the domain is identified as impersonating the Coinbase brand.

While the HTTP response code, page title, and content have not been publicly disclosed, the accumulated evidence from multiple detection sources confirms a high‑risk brand‑impersonation threat. Defenders should incorporate the domain into existing blocklists, enforce DNS sink‑hole rules for the associated IP range, and monitor for any re‑registration attempts. Continuous re‑scanning with VirusTotal and periodic checks against Google Safe Browsing are recommended to capture any future changes in the domain’s status or hosting infrastructure.