reversal-coinbase[.]com

The domain reversal-coinbase.com has been identified as a credential-theft phishing site specifically targeting Gmail users. Analysis confirms the domain is currently offline, though it previously hosted a page impersonating the Google login interface, as evidenced by the page title 'Google.' The threat type is classified as brand impersonation with a high-risk assessment due to its direct targeting of authentication credentials. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on December 24, 2025, and resolved to the IP address 142.251.42.132, hosted on Cloudflare's network (AS13335). Detection metrics indicate the domain was flagged by 17 of 95 security vendors on VirusTotal, and it appears on three independent security blocklists, including entries from PhishDestroy, MetaMask, and SEAL. Notably, the domain lacked an SSL certificate, further degrading its legitimacy and increasing the risk of credential interception. Current status confirms the domain has been taken offline, though residual risk remains for users who may have interacted with the site prior to its deactivation. Organizations and individuals are advised to block the domain at the network level, revoke any credentials potentially exposed during the active period, and monitor for unauthorized access attempts. Security teams should treat this domain as a confirmed malicious indicator and update detection rules accordingly to prevent future engagement.