401564coinbase[.]com

This domain, 401564coinbase.com, poses a high-risk brand impersonation threat designed to deceive users of the legitimate Coinbase cryptocurrency platform. Analysis indicates the site mimics Coinbase’s branding, including logos, layout, and terminology, to trick visitors into entering sensitive account credentials or transferring cryptocurrency to attacker-controlled wallets. The page title "Case ID" suggests an attempt to create a false sense of urgency, likely prompting users to resolve a fabricated account issue, which is a common tactic in crypto drainer and credential theft schemes. Infrastructure analysis reveals multiple red flags confirming the malicious nature of this domain. The domain was registered on March 01, 2026, through OwnRegistrar, Inc., and resolves to the IP address 87.121.79.166, hosted in the Netherlands under AS213725 (03AI LTD). Security vendors on VirusTotal flagged the domain as malicious, with 21 out of 95 engines detecting it as harmful. Additionally, the domain appears on three security blocklists and is actively blocked by multiple threat intelligence feeds, including those used by browser extensions and wallet security tools. The SSL certificate, issued by Let’s Encrypt, does not mitigate the risk, as it is commonly exploited by threat actors to lend a false sense of legitimacy. Users who visited 401564coinbase.com should take immediate action to secure their accounts and assets. If any credentials were entered, reset passwords for Coinbase and any other platforms where the same credentials may have been reused. Enable multi-factor authentication (MFA) on all accounts, preferably using an authenticator app rather than SMS-based methods. Monitor Coinbase and linked bank accounts for unauthorized transactions, and report any suspicious activity to the platform’s support team. If cryptocurrency was transferred to an unknown wallet, document the transaction details and report the incident to relevant authorities or cybercrime units. Avoid interacting with the domain further, and consider using browser-based security tools to block known malicious sites automatically.