954631coinbase[.]com

On July 24, 2026 analysts observed that the domain 954631coinbase.com, created on 21 February 2026, is being used to impersonate the cryptocurrency exchange Coinbase. The domain resolves to the IP address 188.114.97.3, which is part of Cloudflare’s AS13335 network and is geolocated to the United States. No SSL certificate is presented; HTTP connections are likely unencrypted, and the site is currently offline. The page title returned from the endpoint is “Google,” providing no indication of legitimate Coinbase branding. Registration details list OwnRegistrar, Inc. as the registrar, and the domain is served by the Cloudflare nameservers aaden.ns.cloudflare.com and holly.ns.cloudflare.com.

Reputation services have flagged the domain. VirusTotal records show three of ninety‑five scanning engines flagging the host as malicious, and three independent blocklists have already added the domain to their deny lists. Additional protective products—including PhishDestroy, MetaMask, and SEAL—have reported the domain as blocked, confirming cross‑vendor detection of the threat. The Gridinsoft trust score is recorded as 0 out of 100, indicating a lack of confidence in the site’s legitimacy. The available evidence points to a crypto‑related scam, specifically a brand‑impersonation campaign targeting Coinbase users.

However, the exact payload, credential‑harvesting mechanism, or redirect chain has not been captured, leaving the detailed attack flow uncertain. Similarly, the absence of a TLS certificate prevents verification of any attempted man‑in‑the‑middle protection, and the page content beyond the generic title has not been archived. Defenders should add 954631coinbase.com to local and network‑level blocklists, enforce DNS filtering that incorporates the known blocklists, and monitor traffic to the associated Cloudflare IP range for any resurgence.