729281coinbase[.]com

The domain 729281coinbase.com was registered through NameSilo, LLC on December 24, 2025 and is currently listed as offline. Technical resolution shows the domain pointing to IP address 89.125.209.62, which is hosted in the Netherlands under AS212477 owned by RoyaleHosting BV. The authoritative nameservers are emely.ns.cloudflare.com and yoxall.ns.cloudflare.com, indicating the use of Cloudflare DNS services but no TLS certificate is presented for the site, leaving the connection unencrypted. The page title returned by the HTTP response is the generic string "Loading...", and the site lacks any SSL indicator, which is consistent with a rapidly deployed malicious landing page.

Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of reputation. VirusTotal analysis records four detections out of ninety‑three scanning engines, confirming that multiple security products have flagged the domain as malicious. The domain is also present on a single external security blocklist and has been blocked by the PhishDestroy mitigation service. The threat classification is a brand impersonation targeting Coinbase, specifically identified as a crypto‑related scam.

While the exact payload or credential‑harvesting mechanisms have not been publicly disclosed, the convergence of registrar data, hosting location, absence of encryption, low trust score, and multiple vendor detections provides strong evidence of malicious intent. Defenders should continue to block the domain at network perimeter devices, update DNS sinkhole lists, and monitor for any residual traffic from the associated IP range. Incident response teams should also consider correlating logs for attempts to contact this domain with user reports of unauthorized Coinbase activity, and advise users to verify any unsolicited communications that reference Coinbase credentials or crypto transactions.