en-coinbase[.]weebly[.]com

The domain en-coinbase.weebly.com was created on March 29, 2006 and is hosted on the Weebly platform, as indicated by the IP address 74.115.51.8 belonging to AS27647 (Weebly, Inc.) in the United States. The site was fronted by Cloudflare and presented an SSL certificate issued by Let’s Encrypt (E8). HTTP requests return a 404 status, and the page title observed during the short crawl is “Coinbase Extension | Smart, Simple & Secure Crypto Access,” which directly references the targeted brand. The registrar listed is Safenames Ltd., and the authoritative name servers are ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, and ns-646.awsdns.

Google Safe Browsing classifies the URL as a social‑engineering threat, and the domain appears on a single security blocklist. VirusTotal analysis shows that 16 of 93 scanned security vendors flagged the domain as malicious, reinforcing the suspicion of a credential‑stealing or crypto‑drain scheme. PhishDestroy has already taken the site offline. The evidence collectively confirms a brand‑impersonation campaign aimed at Coinbase users, likely leveraging the “Coinbase Extension” phrasing to lure victims into installing a malicious browser extension or providing account credentials.

Uncertainty remains regarding the exact payload delivered, as the site returned a 404 and no further page content was captured. Defenders should immediately add the domain and its resolving IP address to deny‑lists, enforce URL filtering for the observed hostnames, and monitor for similar Weebly‑hosted assets that reference Coinbase or cryptocurrency services. Continuous re‑evaluation of related subdomains and future registrations using the same registrar or hosting provider is recommended to pre‑empt replication of this infrastructure.