631333-coinbase[.]com

On July 24, 2026, the domain 631333-coinbase.com was identified as a brand‑impersonation infrastructure targeting Coinbase users. The registration record indicates the domain was created on February 21, 2026. DNS resolution points to the IPv4 address 185.158.133.1, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to Poland. The TLS certificate presented for the host is identified as “WE1”, suggesting a self‑signed or low‑reputation certificate not issued by a public CA. A HTTP request to the site returned a page whose title is “Coinbase - Sign‑In”, matching the brand target field and confirming a crypto‑scam profile. VirusTotal analysis shows that nine of ninety‑five scanning engines flagged the domain as malicious, providing additional corroboration of its hostile nature. The domain appears on a single security blocklist and is currently listed as blocked by the PhishDestroy service, indicating that at least one community‑driven sinkhole has taken it offline. The site’s operational status is reported as offline, which may limit immediate exposure but does not eliminate the risk of re‑activation or reuse of the same infrastructure.

Analysis of the available data leaves several open questions. The exact payload delivered to victims, the presence of any credential‑stealing scripts, and the full scope of the phishing kit remain unknown because no full page content or network traffic has been captured. Additionally, while the IP address is shared with many legitimate Cloudflare customers, the lack of additional hosting indicators makes attribution to a specific threat actor difficult.

Defenders should proactively block 631333-coinbase.com at DNS and proxy layers, add the associated IP 185.158.133.1 to network‑level deny lists, and monitor for any future re‑registration of the domain or similar look‑alike variations.