coinbaseak[.]com

The domain coinbaseak.com was created on 16 October 2025 and is registered through Gname.com Pte. Ltd. It resolves to the IP address 172.67.148.42, which belongs to the Cloudflare network (AS13335) and is located in the United States. The authoritative nameservers are jimmy.ns.cloudflare.com and thea.ns.cloudflare.com, confirming that the site is fronted by Cloudflare. No SSL certificate is present, meaning the site is served without HTTPS encryption, a common characteristic of low‑quality fraudulent infrastructure. The page title returned by the site, "Buy sell your cryptos and foreign exchange," directly references cryptocurrency trading, matching the classified scam type of "Crypto Scam" and indicating an attempt to lure victims with promises of financial services.

Detection signals reinforce the malicious assessment. The Gridinsoft trust score is 0 / 100, reflecting a complete lack of credibility. Google Safe Browsing flags the domain for social engineering, and it appears on one additional security blocklist. VirusTotal reports that 14 of 95 scanned security vendors flag the domain, providing independent corroboration of its malicious nature. The site is listed as impersonating Coinbase, the well‑known cryptocurrency exchange, which aligns with the brand target information supplied. The current operational status is offline, and PhishDestroy has already taken the domain down, indicating that defensive actions have been effective but that the infrastructure may be reused in the future.

Defenders should immediately add coinbaseak.com to URL filtering and DNS blocklists across corporate networks and endpoint security solutions. Because the hosting IP is part of Cloudflare's shared pool, monitoring for new domains that resolve to the same IP or share the same nameserver set is advisable. Continuous watch for similarly crafted domains that incorporate the "coinbase" keyword will help pre‑empt re‑deployment of the phishing kit.