wildcard[.]791826coinbase[.]com

The domain wildcard.791826coinbase.com was registered on February 21, 2026 and is presently taken offline. Infrastructure analysis shows the domain resolves to the IP address 172.203.144.85, which belongs to the AS8075 Microsoft Corporation network located in the United States. The hosting environment presents a Plesk Obsidian 18.0.74 control panel, as indicated by the page title returned from the server. An SSL certificate labeled “R13” is associated with the domain, confirming that HTTPS was provisioned, but the certificate details have not been disclosed.

The domain is flagged by eight of ninety‑three VirusTotal scanners, and it appears on a single external security blocklist. PhishDestroy has listed the domain as blocked, and Gridinsoft assigns it a trust score of zero out of one hundred, reflecting an extremely low confidence rating. The intelligence attributes the site to a crypto‑scam campaign that impersonates the Coinbase brand, consistent with the “Crypto Scam” classification supplied.

While the available data confirms the domain’s creation date, hosting provider, SSL presence, and detection metrics, no public content analysis or visual inspection has been performed, leaving the exact malicious payload or credential‑harvesting mechanism unverified. Defenders should immediately add the domain and its resolved IP address to network blocklists, enforce DNS sink‑holing for the name, and monitor for any resurgence of activity. Continuous re‑scanning with multi‑vendor sandboxes is advised to capture any evolving payloads, and threat‑intel feeds should be updated to reflect the current offline status while retaining historical indicators for future correlation.