coinbasetrading[.]xyz

coinbasetrading.xyz was registered on March 06, 2026 through GoDaddy, LLC and immediately began serving HTTP 200 responses that mimic the visual style of the Coinbase platform. The domain name incorporates the trusted brand and is listed on three public blocklists, indicating active abuse. The threat is classified as a cryptocurrency‑related brand impersonation targeting users of the Coinbase service, and the risk level is high. Technical analysis shows the domain resolves to IP 76.223.105.230, which is hosted in the United States and belongs to AS16509 Amazon.com, Inc. The authoritative nameservers are ns71.domaincontrol.com and ns72.domaincontrol.com, both operated by the registrar. The site presents a valid GoDaddy Secure Certificate (G2) and enforces HSTS, which can lend an illusion of legitimacy. Gridinsoft assigns a trust score of 0/100, and VirusTotal records five detections out of ninety‑five scanners, reinforcing the malicious classification. The page is built with a commercial website‑builder platform and loads a RequireJS JavaScript module loader together with an embedded support‑chat widget. These components are commonly used in phishing kits to replicate legitimate login flows. No additional payloads were observed, but the presence of a fully rendered login interface aligned with Coinbase branding suggests credential harvesting. Defenders should add 76.223.105.230 and coinbasetrading.xyz to web‑filter deny lists, monitor DNS queries for the domain and its nameservers, and enforce multi‑factor authentication for any Coinbase accounts. User education campaigns must highlight the exact domain spelling and warn that legitimate Coinbase communications never originate from *.xyz addresses. Continuous re‑scanning of the host is advised to detect any future payload changes.