442648coinbase[.]com

Analysis of the domain 442648coinbase.com indicates a deliberate impersonation of the Coinbase brand. The domain was registered on 2025-10-06 through NiceNIC International Group Co., Limited and resolved to the IP address 104.21.20.162, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site was hosted behind Cloudflare’s network, but it did not present a valid SSL certificate, which is atypical for legitimate financial services and increases the risk of credential interception. The HTTP page title returned “Sign in”, matching the credential‑harvesting pattern commonly used in crypto‑related scams. The scam type is explicitly listed as “Crypto Scam”. No further page content has been captured because the site is currently offline.

Reputation services provide a consistent negative assessment. Gridinsoft assigned a trust score of 0 / 100, while Scamadviser reported a score of 21 / 100, reflecting a high likelihood of malicious intent. VirusTotal recorded nine detections out of ninety‑five scanning engines, confirming that several security vendors have identified the domain as malicious. The domain appears on at least one public security blocklist, and PhishDestroy has flagged it as taken down, confirming that active mitigation has been applied. Uncertainties remain around the specific phishing kit or infrastructure used, as no additional indicators such as JavaScript payload hashes or secondary C2 hosts have been disclosed.

The lack of an SSL certificate and the reliance on Cloudflare’s free DNS may suggest a low‑cost, fast‑deployment operation, but further forensic capture would be required to confirm the exact methods employed. Defenders should block any outbound connections to 104.21.20.162 and add 442648coinbase.com to domain‑allow‑list exclusions. Email gateways should be tuned to detect subject lines or body content that reference “Coinbase” login prompts originating from this domain.