coinbaseai[.]app

Analysis conducted on 25 July 2026 identifies the domain coinbaseai.app as part of a brand‑impersonation campaign targeting Coinbase users. The site presents a page title of “coinbase”, which aligns with the declared brand target. The domain resolves to the IP address 104.21.30.16, which belongs to AS13335 Cloudflare, Inc., indicating that the infrastructure is hosted behind Cloudflare’s network. Registration records show the domain was provisioned through Cloudflare, Inc., and the authoritative nameservers are sara.ns.cloudflare.com and troy.ns.cloudflare.com. No TLS certificate was observed, meaning the site was reachable only over plain HTTP.

VirusTotal scans returned 11 positive detections out of 95 security vendors, confirming that a notable subset of anti‑malware products flag the domain as malicious. Additional reputation data include a Gridinsoft trust score of 1 out of 100 and inclusion on one external security blocklist. The site has been classified as a “Crypto Scam” and is listed as impersonating Coinbase. As of the assessment date the domain has been taken offline and is blocked by the PhishDestroy mitigation service. The available evidence points to a typical phishing infrastructure that leverages Cloudflare’s free hosting to obscure the true operator while presenting a convincing brand name in the page title.

The lack of SSL/TLS, low trust score, and multiple vendor detections increase confidence that the domain was used for malicious purposes. However, the offline status prevents direct observation of payloads or credential‑harvesting mechanisms, leaving the exact attack vector uncertain. Defensive recommendations include adding coinbaseai.app to local deny lists, blocking its resolved IP 104.21.30.16 at the network perimeter, and monitoring other domains that resolve to the same Cloudflare IP range for similar brand‑impersonation patterns.