coinbaselive[.]support

coinbaselive.support is an active‑use domain that was registered on 21 February 2026. DNS resolution returns the IPv6 address 2600:1901:0:84ef::, which belongs to AS396982 operated by Google LLC and is geolocated to the United States. A TLS certificate identified as “E7” is presented for the site, indicating a possibly low‑grade or self‑signed certificate. The page title returned from the host is “Coinbase Customer Support Help Center | Coinbase customer support”, matching the brand target “coinbase” and confirming a brand‑impersonation intent.

VirusTotal has recorded 16 detections out of 93 scanning engines, demonstrating that a notable subset of security products flag the domain as malicious. The domain is currently listed on a single public blocklist, PhishDestroy, and the blocklist entry confirms its classification as a crypto‑related scam. The site’s status is reported as offline, suggesting that the hosting service has been taken down or the domain has been suspended. No additional intelligence such as Safe Browsing status, OTX mentions, or registrar details are available in the current dataset.

Because the infrastructure points to a Google‑owned address space, attribution to a specific threat actor remains uncertain. Defenders should continue to block the domain at network perimeter, monitor for similar IPv6 prefixes used by other impersonation campaigns, and ensure that endpoint security solutions are updated to reflect the 16 VirusTotal detections. Ongoing observation of the domain’s registration details and any re‑appearance on blocklists is recommended to capture potential re‑use.