389291coinbase[.]com

The domain 389291coinbase.com was registered on October 31, 2025 through NiceNIC International Group Co., Limited and is hosted on the IP address 81.17.18.98, which maps to a Swiss entity (AS51852 Private Layer INC). The domain resolves to Cloudflare nameservers marge.ns.cloudflare.com and uriah.ns.cloudflare.com, yet it does not present a valid SSL certificate, leaving the HTTP connection unencrypted. The page title returned by the server is "Client Portal," a phrase commonly associated with legitimate Coinbase services, and the site is linked to an Airdrop Scam phishing kit, indicating a cryptocurrency‑focused impersonation campaign. Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of confidence in the domain's legitimacy.

Threat intelligence platforms have flagged the domain on at least one security blocklist, and PhishDestroy has taken the site offline. VirusTotal analysis shows that 13 of 95 scanning engines raise detections, reinforcing the suspicion of malicious intent. The domain explicitly impersonates Coinbase and is categorized as a crypto scam. While the offline status limits immediate exposure, defenders should continue to monitor the associated IP range and Cloudflare name server pair for any re‑activation, block the domain at perimeter defenses, and update URL filtering policies to include this indicator.

Additional verification of traffic patterns to 81.17.18.98 may reveal related command‑and‑control activity. Organizations that rely on Coinbase services should educate users about the lack of SSL and the "Client Portal" title as potential lure elements, and enforce multi‑factor authentication to mitigate credential compromise. The current evidence is limited to registration, hosting, and detection metadata; no content‑level analysis is available, so further inspection of any revived site would be required to confirm the full scope of the phishing kit.