coinbase-wallet-v1[.]com

Analysis indicates that coinbase-wallet-v1.com was registered on 21 February 2026 through Web Commerce Communications Limited dba WebNic.cc and uses the authoritative nameservers ns100.webnic.cc and ns101.webnic.cc. The domain resolves to the IPv6 address 2606:4700:3036::6815:273a, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. An SSL certificate identified as “WE1” is present, but its provenance provides no additional credibility. Gridinsoft assigns the domain a trust score of 0 out of 100, reflecting a lack of reputational history.

The page title returned from the site, “Coinbase Wallet: Securely Manage Your Crypto Assets,” directly references the Coinbase brand, aligning with the classified scam type of wallet/seed phishing and indicating a brand‑impersonation motive. VirusTotal analysis shows that 10 of 93 security vendors have flagged the domain, and the domain is listed on one known security blocklist. PhishDestroy has already taken action to block the site, and the current operational status is offline, suggesting that the hosting has been taken down or the domain has been disabled following detection. The available evidence confirms that the domain is being used to masquerade as a legitimate Coinbase wallet service, likely to harvest private keys or seed phrases from unsuspecting users.

However, without a detailed page capture, the specific harvesting mechanism and any additional malicious payloads remain uncertain. Defenders should continue to block the domain at network perimeter devices, ingest the IPv6 address and associated ASN into threat intelligence feeds, and monitor the registrar and nameserver infrastructure for any re‑registration attempts. Users should be warned that any unsolicited request to manage cryptocurrency assets through a URL containing “coinbase‑wallet‑v1.com” is malicious, and legitimate Coinbase communications will never use this domain.