# 932847-coinbase.com — MALICIOUS

> 932847-coinbase.com impersonates Coinbase in a social engineering scam. Avoid interaction and report suspicious activity immediately.

## Summary
PhishDestroy identifies 932847-coinbase.com as a high-risk brand impersonation domain targeting Coinbase users. Classified as a phishing site, it aims to deceive victims by mimicking the legitimate Coinbase brand to harvest sensitive credentials. The domain’s page title is flagged as a suspected phishing site by Cloudflare, reinforcing its malicious intent.

Technical indicators further confirm the threat: 932847-coinbase.com was registered recently on March 2, 2026, through NiceNIC International Group Co., Limited. It resolves to IP 188.114.97.3 and is listed on two security blocklists. Google Safe Browsing categorizes it under SOCIAL_ENGINEERING, while VirusTotal identifies it as malicious by 13 out of 95 security vendors, indicating a widely recognized phishing threat.

Currently, the domain is offline, reflecting swift action following detection. This status prevents active exploitation but does not negate the risk posed during its operation period. Users and organizations should remain vigilant for similar impersonation attempts and report any suspicious Coinbase-related domains promptly to protect against credential theft and fraud.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 0)
- Target brand: Coinbase
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-03-02 15:00:01
- Registrar: NiceNIC International Group Co., Limited
- Country: HK
- IP: 188.114.97.3
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: emerson.ns.cloudflare.com reza.ns.cloudflare.com
- SSL Issuer: none

## Detection Status
- VirusTotal: 13 vendors flagged
  Vendors: ["ADMINUSLabs", "ChainPatrol", "alphaMountain.ai", "BitDefender", "CRDF", "CyRadar", "ESET", "Fortinet", "G-Data", "Google Safebrowsing", "Lionic", "Seclookup", "SOCRadar"]
- Google Safe Browsing: FLAGGED
- Blocklists: 2 hits
  Lists: ["PhishDestroy", "MetaMask"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019caea7-7b17-759d-8526-de6461cea567.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/e5c2f2c6-3565-4c6a-8492-35a1e10f13b0
- PhishDestroy: https://phishdestroy.io/domain/932847-coinbase.com/
- LLM endpoint: https://phishdestroy.io/domain/932847-coinbase.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/932847-coinbase.com/
Last updated: 2026-03-19