myaccount-coinbase[.]com

Analysis as of July 23 2026 shows that the domain myaccount-coinbase.com was registered on October 21 2025 through NiceNIC International Group Co., Limited and currently points to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The domain is served by Cloudflare nameservers brianna.ns.cloudflare.com and zod.ns.cloudflare.com and does not present an SSL certificate, indicating that any HTTP request would be unencrypted. VirusTotal records indicate that 14 of 93 security vendors have flagged the domain, demonstrating moderate detection across multiple scanners. The domain appears on one public security blocklist and has been blocked by PhishDestroy, reinforcing its malicious classification.

AlienVault OTX cites the domain in four separate threat‑intelligence pulses, providing additional corroboration of its use in malicious campaigns. Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating. The page title returned by the web server is “Sign in – Google Account”, while the brand target listed in the intelligence is Coinbase, and the scam type is identified as a crypto scam. These indicators together suggest a brand‑impersonation attempt that leverages a familiar Google login prompt to lure Coinbase users into a credential‑harvesting flow.

The domain’s current status is offline, but the underlying IP and hosting infrastructure remain active. Defenders should continue to block the domain at network perimeter devices, add the IP 188.114.97.3 to deny‑list rules, and monitor for new subdomains or similarly named domains hosted on the same Cloudflare nameservers. Correlation of future detections with the observed OTX pulses and the PhishDestroy blocklist will aid in early identification of related campaigns. Continuous ingestion of the 14 vendor detections from VirusTotal and the zero‑trust score from Gridinsoft into SIEM correlation rules is recommended to reduce exposure to this brand‑impersonation threat.