staging[.]dept-coinbase[.]com

Analysis indicates that the domain staging.dept-coinbase.com is actively hosting a crypto‑related impersonation campaign targeting Coinbase users. The domain was registered on September 04, 2025 and resolves to the IP address 15.197.130.221, which belongs to Amazon.com, Inc. (AS16509) and is physically located in the United States. The registration was performed through Hosting Concepts B.V. d/b/a Registrar.eu, and the authoritative nameservers listed are ina1.registrar.eu, ina2.registrar.eu, ina3.registrar.eu, josh.ns.cloudflare.com, and ros. No SSL certificate is presented for the site, yet the HTTP response returns a status code of 200, indicating that the server delivers content over plain HTTP.

The page title returned by the server is "dept-coinbase.com," reinforcing the brand‑impersonation intent. VirusTotal has recorded detections from three of ninety‑five scanning engines, confirming that at least a subset of security products recognize the domain as malicious. The domain appears on one external security blocklist and has been flagged by the PhishDestroy service, demonstrating that community‑driven defenses have already taken notice. The listed scam type is "Crypto Scam," which aligns with the Coinbase brand targeting.

While the exact payload or credential‑harvesting mechanisms have not been publicly disclosed, the available evidence—registration details, hosting infrastructure, lack of TLS, and multiple vendor detections—strongly suggests a high‑risk phishing operation. Defenders should immediately block staging.dept-coinbase.com at perimeter and DNS filtering layers, add the associated IP address to network‑level deny lists, and ensure that any outbound connections to the listed nameservers are monitored. Continuous monitoring of VirusTotal, threat intel feeds, and any emerging blocklist entries is advised to capture potential changes in the domain's behavior.