coinbasesurveys[.]com

coinbasesurveys.com is a newly registered domain (creation date July 24 2026) that has been identified as a generic phishing site targeting users of the Coinbase platform. The domain is active and resolves to the IP address 134.122.27.71, hosted under the nameservers ns3.my-ndns.com and ns4.my-ndns.com. Reputation services have flagged the domain: VirusTotal reports 15 of 91 security vendors flagging it, Google Safe Browsing categorises it as social engineering, and it appears on the PhishDestroy blocklist. The registrar listed is NICENIC INTERNATIONAL GROUP CO., LIMITED.

No further technical details such as SSL certificate information, HTTP response codes, or page titles have been disclosed in the current intelligence set. Analysis indicates that the rapid appearance of multiple detections within days of registration suggests an opportunistic phishing campaign, possibly leveraging compromised infrastructure to host malicious pages. The presence on a dedicated anti‑phishing blocklist confirms that at least one security organization has observed malicious activity associated with the domain. However, the limited number of detections (15 vendors) and the single blocklist entry leave uncertainty regarding the full scope of the campaign, the payload delivered, and whether the site is still serving phishing content at the time of assessment.

Defenders should block or sinkhole the domain at network perimeter and DNS layers, monitor outbound connections to the associated IP address, and update web‑filtering rules to include the identified nameservers. Incident response teams should treat any credential submissions to coinbasesurveys.com as compromised and advise affected users to reset credentials and enable multifactor authentication. Continuous monitoring of VirusTotal, Google Safe Browsing, and other reputation feeds is recommended to capture any changes in detection prevalence or additional blocklist listings.