dss-br[.]coinbase[.]com[.]lc

Analysis of the domain dss-br.coinbase.com.lc shows that it resolves to the IPv4 address 75.2.18.233, which is announced by Amazon.com, Inc. under ASN 16509. The host is located in the United States and serves web content via Nginx/OpenResty. A Let’s Encrypt certificate (R13) is active, providing TLS encryption without any certificate name mismatch.

The site presents the page title "coinbase.com.lc" and is explicitly listed as impersonating the Coinbase brand. The HTTP response code is 200, indicating a fully reachable web service. Threat intelligence sources rate the domain extremely poorly: Gridinsoft assigns a trust score of 0/100, Scamadviser 1/100, and VirusTotal reports 14 out of 95 security vendors flagging the host as malicious. Google Safe Browsing classifies the URL under the SOCIAL_ENGINEERING category, and the domain is currently blocked by PhishDestroy and appears on one additional security blocklist.

While the technical footprint confirms a high‑risk infrastructure, the public data does not include a content scrape or a detailed examination of the landing page. Consequently, the exact phishing kit, credential‑capture mechanisms, or any malicious payloads remain unverified. The presence of a single MX record pointing to mx156.hostedmxserver.com suggests that the operators may also be exploiting email channels, but no further mail traffic analysis is available.

Defenders should treat dss-br.coinbase.com.lc as a high‑confidence brand‑impersonation threat. Immediate actions include adding the domain to DNS and proxy blocklists, enforcing email filtering rules for the associated MX host, and monitoring network traffic for connections to the 75.2.18.233 endpoint. Continuous re‑evaluation is advised, as any change in the underlying content or additional indicators could increase the operational impact.