eng-coinbase[.]com

This domain, eng-coinbase.com, is actively impersonating Coinbase as part of a crypto scam operation. Registered on November 29, 2025, through Dynadot LLC, the domain resolves to IP address 199.59.243.228, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. Analysis indicates the use of an airdrop-themed phishing kit, a common tactic in cryptocurrency fraud schemes designed to deceive users into disclosing credentials or transferring funds. The site employs Cloudflare for hosting and security, including HTTP/3 and Cloudflare Browser Insights, which may obscure backend infrastructure and hinder takedown efforts. The SSL certificate, issued by Google Trust Services (WE1), suggests a legitimate appearance, though this is a standard feature of many phishing domains. As of July 12, 2026, the domain remains active, returning an HTTP 200 status, and is flagged by 18 of 95 security vendors on VirusTotal. It appears on at least one security blocklist, with a trust score of 0/100 from Gridinsoft. The page title matches the domain name, though no further content analysis has been conducted to confirm specific phishing mechanisms or user interaction flows. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where cryptocurrency transactions or Coinbase-related services are in use. Given the domain's age and active status, monitoring for related infrastructure (e.g., nameservers ns1.dyna-ns.net and ns2.dyna-ns.net) may help identify additional threats. No evidence suggests this domain is part of a broader campaign, but the use of a known phishing kit warrants heightened scrutiny.