coinbaseserviceaiddesk[.]com

Analysis of coinbaseserviceaiddesk.com confirms this domain operated as a crypto scam impersonating Coinbase, active until recently taken offline. Registered on May 9, 2025, through Global Domain Group LLC, the domain resolved to 198.251.89.220, an IP address assigned to AS53667 FranTech Solutions in the United States. Infrastructure analysis reveals the use of nameservers ns27.asurahosting.com, ns27.my-control-panel.com, ns28.asurahosting.com, and ns28.my-control-panel.com, with no SSL certificate detected. The page title was recorded as 'Bot Verification,' and the domain was classified as a Verification Scam phishing kit, aligning with the reported scam type of crypto fraud.

Detection data from July 24, 2026, shows the domain was flagged by 7 of 95 security vendors on VirusTotal, though the specific vendors and detection rules are not disclosed. It appears on one security blocklist and was blocked by PhishDestroy. Gridinsoft assigned a trust score of 0/100, indicating high risk. Technologies detected on the domain include LiteSpeed and HTTP/3, though their role in the scam remains unconfirmed.

Defenders should note that while the domain is currently offline, its infrastructure—particularly the hosting provider and nameservers—may still pose risks if reused for similar campaigns. The absence of SSL further suggests minimal effort to establish legitimacy. Given the domain's association with a known phishing kit and its brief operational window, monitoring for re-registration or related domains under the same registrar or hosting provider is recommended. No additional evidence links the domain to broader threat actor infrastructure at this time.