wallet-whitelist-coinbase[.]com

wallet-whitelist-coinbase.com was observed hosting a fraudulent page that presents the title “Coinbase: The Most Trusted Place To Buy, Sell & Use Crypto”. The page is designed to impersonate the Coinbase brand, and the underlying scam type is classified as a crypto‑scam. The domain was registered on 21 February 2026 and currently resolves to the IPv4 address 150.40.121.24, which is allocated to AS211619 operated by MAXKO d.o.o. in Croatia.

An SSL certificate labeled “E7” is present, indicating that HTTPS is offered despite the domain’s malicious intent. VirusTotal reports eight of ninety‑three scanned scanners flagging the host as malicious, reinforcing the suspicion of abuse. The domain appears on a single public blocklist; PhishDestroy has already taken action to block it, and the site’s status is reported as offline. No additional evidence such as Safe Browsing alerts, OTX mentions, or registrar details were provided.

The limited telemetry suggests the infrastructure is modest, relying on a single IP address and a recently issued certificate. Analysts should continue to monitor the IP for any resurgence, add the domain and its IP to local deny lists, and ensure that URL filtering solutions reference the PhishDestroy blocklist. Organizations that allow outbound connections to unknown hosts should verify that traffic to 150.40.121.24 is blocked, and users should be reminded that legitimate Coinbase communications never originate from this domain.