coinbasepromotionclaims[.]com

This domain, coinbasepromotionclaims.com, is identified as a high-risk brand impersonation threat targeting users of the Coinbase cryptocurrency platform. Analysis indicates the domain was designed to mimic legitimate Coinbase promotions, tricking users into divulging account credentials, private keys, or other sensitive information under the guise of exclusive offers or giveaways. The page title, 'Coinbase - Cryptocurrencies,' reinforces the deception by closely resembling the authentic Coinbase interface, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals the domain was registered through Ultahost, Inc. on January 09, 2026, and resolves to the IP address 80.94.92.57, located in Romania under AS47890 (UNMANAGED LTD). The domain appears on four security blocklists and is flagged by 19 out of 95 security vendors on VirusTotal, indicating widespread detection as malicious. The SSL certificate, classified as R13, further suggests non-standard or potentially compromised encryption practices. Additional blocking by multiple security frameworks underscores the severity of the threat. Users who visited coinbasepromotionclaims.com should immediately revoke any active sessions, reset passwords for associated accounts, and enable multi-factor authentication where available. If financial or cryptocurrency transactions were initiated, affected parties should contact their financial institution or wallet provider to report potential fraud. Monitoring for unauthorized access or unusual activity is strongly advised, and any credentials entered on the site should be considered compromised. The domain is currently offline, but users should remain vigilant for similar phishing attempts targeting cryptocurrency platforms.