nebkjm[.]coinbase[.]earth

Analysis indicates that the domain nebkjm.coinbase.earth was registered on 26 October 2024 through Porkbun LLC and is served by four Porkbun‑controlled name servers (curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com, salvador.ns.porkbun.com). DNS resolution points to the IP address 199.59.243.228, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. No TLS certificate is presented, meaning the site would be accessed over plain HTTP if it were reachable. The page title returned from the host is “coinbase.earth”, matching the domain suffix and reinforcing the branding claim.

The domain is explicitly listed as impersonating Coinbase and is classified as a crypto‑related scam. VirusTotal scans have returned three positive detections out of ninety‑five submitted engines, confirming that multiple security vendors consider the host malicious. The domain appears on a single public blocklist and has been actively blocked by the PhishDestroy mitigation service. Current monitoring shows the site is taken offline, which limits immediate exposure but does not remove the underlying infrastructure.

Defenders should continue to block the IP 199.59.243.228 and the full domain in DNS‑filtering solutions, add the domain to internal deny lists, and monitor the associated name servers for any future re‑registration attempts. Because the registrar is Porkbun, investigators may consider requesting registration details or abuse contacts to facilitate takedown. Ongoing vigilance is advised, as the hosting provider (Amazon) may be leveraged for rapid redeployment of similar impersonation sites.