coinaistock[.]vip

The domain coinaistock.vip is currently active and classified as a high-risk brand impersonation threat targeting Coinbase. Analysis indicates the site falsely presents itself as a Coinbase-affiliated AI stock platform, as evidenced by its page title, 'Welcome to Coinbase AI Stock.' This domain is explicitly designed to deceive users into believing it is an official or endorsed service of the targeted brand, increasing the likelihood of credential theft or financial fraud. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain is flagged by 17 of 95 security vendors on VirusTotal, and it appears on one security blocklist. It was registered on December 08, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with suspicious domains. The site resolves to the IP address 104.21.12.230, hosted on Cloudflare's network (AS13335), which is commonly used to obscure the true origin of malicious infrastructure. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, but this does not mitigate the domain's fraudulent nature. Google Safe Browsing has also classified the domain as phishing, further corroborating its malicious status. The domain remains active and poses a significant risk to users. Immediate action is recommended: security teams should block access to coinaistock.vip at the network level and update detection rules to include its IP address and domain name. Users who may have interacted with the site should be advised to reset credentials, monitor financial accounts for unauthorized activity, and report the incident to relevant fraud prevention authorities. Organizations should also review registrar and hosting provider policies to disrupt similar threats proactively.