wallet[.]coinbaselink[.]net

Analysis of wallet.coinbaselink.net shows a newly registered domain created on 17 October 2025 that is currently taken offline. The domain resolves to IP 72.61.1.85, which is hosted by Hostinger International Limited (AS47583) in the United States. Registration was performed through HOSTINGER operations, UAB, and the authoritative nameservers are ns1.dns‑parking.com and ns2.dns‑parking.com. No TLS certificate is presented, indicating the site served only HTTP content.

The page title returned by the server is “WalletConnect app”, and the domain is classified as a crypto‑scam that impersonates the Coinbase brand. Independent scoring services assign a trust score of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has already blocked the domain, and eight of ninety‑five VirusTotal scanners flagged it as malicious. The lack of SSL, low trust score, and the use of a brand‑related title are consistent with typical cryptocurrency‑related impersonation campaigns.

Because the site is offline, live content cannot be inspected, leaving the exact phishing flow and credential‑capture mechanisms uncertain. Defenders should continue to block the domain and the associated IP address at network perimeter and DNS filtering layers. Security teams should add the domain and its IP to threat‑intel feeds, monitor for similarly named variations that target Coinbase users, and consider updating endpoint detection rules to flag any process that attempts to communicate with this host. Ongoing observation of Hostinger‑owned IP ranges for new domains with comparable creation dates may help identify future campaigns before they become active.