coinbasegenie[.]info

This domain, coinbasegenie.info, is flagged for brand impersonation targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates the site mimics legitimate Coinbase login portals to harvest user credentials, likely deploying a credential-harvesting kit designed to exfiltrate sensitive account information. The domain’s infrastructure and page title (coinbasegenie.info) suggest a deliberate attempt to deceive users into believing they are accessing an official Coinbase service, while the underlying intent is to facilitate unauthorized account access or financial theft.

Technical indicators confirm elevated risk: the domain is detected by 11 of 95 security vendors on VirusTotal, registered through Dynadot LLC on November 20, 2025, and resolves to IP address 198.18.2.7 (AS16509, Amazon.com, Inc., US). It appears on one security blocklist and uses a Let's Encrypt SSL certificate (R13). The domain’s creation date is recent, aligning with typical phishing campaign timelines, and its hosting on a cloud provider’s infrastructure is consistent with threat actors leveraging scalable, low-cost resources to deploy malicious sites rapidly.

As of the latest assessment, coinbasegenie.info remains active and unmitigated. No takedown actions have been recorded, and the domain continues to resolve. Users are advised to block the domain at the network level and report it to relevant abuse contacts. Remaining risk is elevated due to the domain’s operational status, lack of widespread blocklisting, and the high-value target (cryptocurrency users). Organizations should monitor for connections to 198.18.2.7 and inspect logs for interactions with the domain, particularly from endpoints handling financial or authentication data.