coinbasepool[.]vip

The domain coinbasepool.vip was registered on 21 February 2026 and is currently taken offline. VirusTotal records show that five of ninety‑five scanned security vendors flagged the domain as malicious, providing a moderate detection consensus. The domain resolves to the IPv4 address 191.101.14.231, which is hosted in the United States by the commercial provider Hostinger. This IP appears on a single public security blocklist, and the domain itself is listed on the PhishDestroy blocklist, confirming that defensive feeds have already classified it as hostile.

Intelligence attributes the site to a crypto‑scam campaign that impersonates the Coinbase brand, matching the declared brand target of Coinbase. No additional infrastructure details such as ASN, SSL certificate information, page title, or HTTP status codes are available because the site is no longer reachable. The elevated risk level reflects the combination of brand impersonation and cryptocurrency‑related financial loss potential.

The short lifespan of the domain and its rapid appearance in multiple threat feeds suggest an opportunistic, drop‑and‑replace operation typical of campaigns that exploit newly registered domains to harvest credentials or funds. Defenders should deny any outbound connections to 191.101.14.231, add coinbasepool.vip to DNS and URL block lists, and monitor WHOIS records for any re‑registration attempts that reuse the same naming pattern or hosting provider. Continuous use of the PhishDestroy feed and other blocklists is recommended to prevent exposure to similar brand‑impersonation crypto scams.