am[.]coinbase[.]com[.]lc

The domain am.coinbase.com.lc is currently active and has been identified as a high‑risk brand‑impersonation site targeting Coinbase users. Infrastructure analysis shows the domain resolves to IP 75.2.18.233, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The web server is identified as Nginx running OpenResty, and the site presents a valid Let's Encrypt certificate (R13). HTTP requests return status 200 and the page title is "coinbase.com.lc". Google Safe Browsing classifies the URL under the SOCIAL_ENGINEERING category, and the domain is listed on a single security blocklist, where it is already blocked by PhishDestroy. VirusTotal scans have flagged the domain by 14 of 95 security vendors, and the Gridinsoft trust score is 0 out of 100, indicating a strong malicious profile. The site is labeled as a Crypto Scam and explicitly impersonates the Coinbase brand. No additional content analysis is available beyond the title, so the exact phishing flow and credential‑stealing mechanisms remain unknown. Defenders should immediately add am.coinbase.com.lc to deny‑list rules for URL filtering, enforce strict domain‑based allowlists for Coinbase access, and monitor outbound traffic to the associated IP address for any anomalous activity. User‑education campaigns should remind employees that a legitimate Coinbase service will never use a sub‑domain under ".com.lc" and that a valid TLS certificate does not guarantee authenticity. Continuous threat‑intel feeds should be consulted for any new indicators related to this infrastructure.