usa[.]coinbasesc[.]club

The domain usa.coinbasesc.club is flagged as a cryptocurrency‑related impersonation of Coinbase. Registration data shows it was created on November 20, 2025 through the registrar 22net, Inc., and it uses the Chinese‑based nameservers ns1.22.cn and ns2.22.cn. DNS resolution points to IP address 45.207.200.104, which belongs to AS8796 FASTNET DATA INC and is geolocated in the United States. No TLS certificate is presented, indicating that the site was served over plain HTTP when active.

The page title returned by the host was "coinbase SC," and the documented brand target is Coinbase with a declared scam type of Crypto Scam. Malware scanning on VirusTotal recorded 14 detections out of 95 security vendors, and the domain appears on a single public blocklist. The Gridinsoft trust engine assigned a score of 0 out of 100, reflecting a high confidence that the site is malicious. PhishDestroy has already taken the domain offline, and its current status is listed as taken offline.

Uncertainties remain regarding the exact content served, any credential‑harvesting forms, and whether additional infrastructure (such as CDN or redirect chains) was used, as no HTTP response details or Safe Browsing verdicts are available. Defenders should immediately add usa.coinbasesc.club to DNS and URL filtering policies, block the associated IP address 45.207.200.104, and monitor for re‑registration or related domains that employ the same registrar or nameserver pattern. Continuous observation of VirusTotal and other sandbox feeds is advised to capture any resurgence, and threat‑intelligence teams should correlate this indicator with other Coinbase‑related abuse reports to assess potential campaign breadth.