renew-coinbase[.]com

Renew-coinbase.com was registered on March 06, 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare edge address 172.67.201.206, which is associated with AS13335 Cloudflare, Inc. in the United States. The domain does not present an SSL/TLS certificate, indicating that HTTPS connections would be unencrypted if the site were reachable. The page title observed during analysis is “Sign in - Coinbase,” directly referencing the targeted brand Coinbase and aligning with the reported crypto‑draining scam type. VirusTotal scans have recorded six detections out of ninety‑five participating security vendors, providing moderate adversary confidence.

The domain is listed on three public security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, demonstrating that several defensive platforms have already incorporated it into their mitigation layers. Nameservers rohin.ns.cloudflare.com and tina.ns.cloudflare.com point to Cloudflare’s DNS infrastructure, a common choice for fast‑flipping phishing operators seeking flexible hosting. Current network probing shows the domain as offline, which may be a temporary takedown or a deliberate removal after a campaign window. Evidence gaps include the absence of a published SSL certificate, lack of publicly available sandbox or sandbox‑derived screenshots, and no open‑source intelligence linking this domain to a larger command‑and‑control infrastructure.

Defenders should continue to monitor the domain for re‑appearance, enforce blocklist updates that include renew-coinbase.com, and consider adding the IP address 172.67.201.206 to network‑level deny lists, recognizing that Cloudflare IPs host many unrelated services. Email security gateways should flag any messages containing URLs to this domain, and endpoint detection solutions ought to reference the VirusTotal detection count as part of their risk scoring.