# 18397coinbase.com — SUSPICIOUS

> 18397coinbase.com was used to impersonate Coinbase with a fake login page. Stay vigilant and avoid entering credentials on suspicious sites.

## Summary
PhishDestroy identifies 18397coinbase.com as a low-risk brand impersonation threat targeting Coinbase users. The domain aimed to deceive visitors by presenting a counterfeit login page with the title "Sign in - Cߋinbаse," closely mimicking the legitimate Coinbase interface but using subtle character substitutions to evade detection.

The domain was registered on March 6, 2026, through NiceNIC International Group Co., Limited and resolved to IP address 172.67.131.231. Despite appearing on two security blocklists, only one out of 95 VirusTotal security vendors flagged the domain, suggesting limited but notable suspicion. The infrastructure and registration details align with common tactics used in phishing campaigns designed to harvest credentials by exploiting brand trust.

Currently, the domain is offline, reducing immediate risk. Users are advised to remain cautious when accessing websites resembling Coinbase and to verify URLs carefully to avoid credential theft. PhishDestroy recommends maintaining up-to-date security measures and consulting official sources to confirm domain legitimacy before submitting sensitive information.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 403)
- Target brand: Coinbase
- Page title: Sign in - Cߋinbаse

## Domain Intelligence
- Registered: 2026-03-06 21:07:02
- Registrar: NiceNIC International Group Co., Limited
- Country: HK
- IP: 172.67.131.231
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["aria.ns.cloudflare.com", "braden.ns.cloudflare.com"]
- SSL Issuer: none

## Detection Status
- VirusTotal: 1 vendors flagged
  Vendors: ["Fortinet"]
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["PhishDestroy", "MetaMask"]

## Evidence
- Screenshot: https://i.ibb.co/Z16ZSw8N/3f65c50c4bb7.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/223e403a-c140-4b37-90d8-2f1e8a551bc6
- Wayback Machine: https://web.archive.org/web/https://18397coinbase.com
- PhishDestroy: https://phishdestroy.io/domain/18397coinbase.com/
- LLM endpoint: https://phishdestroy.io/domain/18397coinbase.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/18397coinbase.com/
Last updated: 2026-03-19