t80228coinbase[.]com

The domain t80228coinbase.com was registered on November 16, 2025 through NiceNIC International Group Co., Limited. It is configured to resolve to the IP address 142.251.167.147, which belongs to Google LLC (ASN15169) and is located in the United States. The domain uses Cloudflare nameservers (lakas.ns.cloudflare.com and liberty.ns.cloudflare.com) but does not present an SSL/TLS certificate, indicating that any HTTP connections would be unencrypted. The only visible page title returned by the server is "Google," providing no direct indication of malicious content, yet the domain is classified as a crypto scam that impersonates the Coinbase brand.

Detection data shows that 11 out of 95 security vendors on VirusTotal have flagged the domain, and it appears on one external security blocklist. Gridinsoft assigns a trust score of 0 out of 100, and PhishDestroy has already taken the domain offline, confirming that the site is no longer reachable. The evidence suggests that the domain was deliberately crafted to exploit Coinbase’s brand reputation for cryptocurrency‑related fraud, but the lack of SSL and the generic page title limit insight into the specific payload or credential‑harvesting mechanisms that may have been employed.

Defenders should continue to block the domain at perimeter defenses, monitor for any residual traffic to the associated IP address, and enforce brand‑specific threat‑intel feeds that include this indicator. Because the site is offline, active investigation of the content is not possible; however, the combination of vendor detections, a zero trust score, and confirmed blocklist inclusion provides a high confidence indication of malicious intent. Organizations should remain vigilant for similar domains that target Coinbase users and apply standard crypto‑scam mitigation practices, including user education and strict URL verification.