# coinbase.hngfrjj.com — SUSPICIOUS

> coinbase.hngfrjj.com mimics Coinbase to steal credentials. Created Sept 20, 2025, hosted on 154.89.71.

## Summary
coinbase.hngfrjj.com is a newly registered domain that impersonates the legitimate cryptocurrency exchange Coinbase to trick users into revealing sensitive login information or payment details. The site presents itself as a Coinbase portal, leveraging the trusted brand name to lower user suspicion and increase the chances of successful credential theft. Users who enter their account credentials or financial data on this fraudulent site risk immediate account compromise and potential financial loss, as attackers can harvest and misuse the information in real time.    PhishDestroy identifies this domain as an active brand impersonation threat based on multiple technical indicators. The domain was registered on September 20, 2025, which is less than one week from this report, suggesting a hastily deployed operation aimed at capitalizing on brand recognition during a short time window. The site is hosted on IP address 154.89.71.218, a server associated with Cloud Yuqu LLC, a registrar that has previously hosted suspicious domains. Critically, VirusTotal currently shows 0 out of 95 security engines detecting this domain, meaning antivirus and browser filters have not yet flagged it as malicious. This low detection rate increases the risk of users encountering and interacting with the site unknowingly.    If you visited coinbase.hngfrjj.com or entered any information, take immediate action: Do not use the same password on other accounts. Change your Coinbase password and enable two-factor authentication right away. Scan your device for malware using a reputable antivirus tool. Report the domain to your browser and email provider to help block future access. Avoid clicking any links in emails or messages that lead to this domain. Stay vigilant for unexpected login attempts or unauthorized transactions.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Coinbase

## Domain Intelligence
- Registered: 2025-09-20 05:39:09
- Registrar: Cloud Yuqu LLC
- IP: 154.89.71.218

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/coinbase.hngfrjj.com
- PhishDestroy: https://phishdestroy.io/domain/coinbase.hngfrjj.com/
- LLM endpoint: https://phishdestroy.io/domain/coinbase.hngfrjj.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/coinbase.hngfrjj.com/
Last updated: 2026-04-04