# 519782coinbase.com — MALICIOUS

> This domain impersonates Coinbase to steal credentials. Flagged by 5 of 95 VirusTotal vendors, it resolves to 172.67.183.49 and was created on March 29, 2026.

## Summary
PhishDestroy identifies 519782coinbase.com as an active Coinbase brand impersonation phishing domain posing an elevated risk to users. The site mimics Coinbase’s login interface to harvest credentials, with a page title of 'Sign in' to enhance deception. This domain was flagged by security vendors for malicious activity and requires immediate caution from internet users.  This domain was flagged by 5 of 95 VirusTotal security vendors, indicating partial but concerning detection. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolves to IP address 172.67.183.49, and was created on March 29, 2026. The domain utilizes a Let's Encrypt SSL certificate to appear legitimate, despite its malicious intent. As of the latest analysis, PhishDestroy has recorded this domain on 3 active blocklists, with low trust scores across multiple threat intelligence platforms.  The domain remains active and should be treated as a high-risk threat to cryptocurrency users. Users are strongly advised to avoid interacting with this domain or entering any credentials. If accessed inadvertently, users should immediately change their Coinbase account passwords and enable two-factor authentication. Organizations and individuals are encouraged to block this domain at the network level and report it to relevant cybersecurity authorities to prevent further exploitation. Continuous monitoring of this domain is recommended due to its active status and evolving tactics.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Coinbase
- Page title: Sign in

## Domain Intelligence
- Registered: 2026-03-29 12:24:07
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 172.67.183.49

## Detection Status
- VirusTotal: 5 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/519782coinbase.com
- PhishDestroy: https://phishdestroy.io/domain/519782coinbase.com/
- LLM endpoint: https://phishdestroy.io/domain/519782coinbase.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/519782coinbase.com/
Last updated: 2026-04-02