# 991772coinbase.com — SUSPICIOUS

> 991772coinbase.com poses a medium phishing risk. Avoid sharing personal info and verify URLs carefully to protect your accounts from scams.

## Summary
PhishDestroy identifies 991772coinbase.com as a medium-risk phishing domain potentially targeting cryptocurrency users by mimicking the well-known Coinbase brand. The domain is designed to deceive users into divulging sensitive information, posing significant risks of unauthorized access and financial loss. Its activity status remains active, signaling ongoing threat potential.

Technically, 991772coinbase.com was registered on March 01, 2026, through Hello Internet Corp, an often-used registrar for fraudulent domains. The domain resolves to IP address 5.175.234.203, which has been linked to suspicious online activities. Although only three out of ninety-five VirusTotal security vendors flagged this domain, this detection rate, combined with its recent creation and domain name characteristics, aligns with observed phishing infrastructure tactics.

Given the domain's active status and medium threat level, PhishDestroy recommends heightened vigilance. Users should avoid interacting with this domain, refrain from sharing credentials or personal data, and verify the legitimacy of any Coinbase-related communications through official channels. Security teams should consider blocking this domain and monitoring related network activity to mitigate potential phishing attempts.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 403)
- Target brand: Coinbase
- Page title: Coinbase

## Domain Intelligence
- Registered: 2026-03-09 07:07:01
- Expires: 2027-03-01 00:00:00
- Registrar: Hello Internet Corp
- Country: US
- IP: 5.175.234.203
- IP Org: Cloudflare CDN
- Nameservers: chloe.ns.cloudflare.com kaiser.ns.cloudflare.com
- SSL Issuer: Let's Encrypt / E8

## Detection Status
- VirusTotal: 1 vendors flagged
  Vendors: ["Seclookup"]
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["PhishDestroy", "MetaMask"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cdeeb-1826-77bb-9420-23dae6d595d3.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/27e139d2-9838-4bec-a815-a342cf706c72
- PhishDestroy: https://phishdestroy.io/domain/991772coinbase.com/
- LLM endpoint: https://phishdestroy.io/domain/991772coinbase.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/991772coinbase.com/
Last updated: 2026-03-19