coinbase-550912[.]com

The domain coinbase-550912.com was registered through NiceNIC International Group Co., Limited on 30 September 2025 and is hosted on IP 193.23.3.108, which belongs to AS9002 RETN Limited in Latvia. The authoritative nameservers are ns3.my-ndns.com and ns4.my-ndns.com. No TLS certificate is presented, indicating the site served only HTTP. The sole page discovered returned the title “Coinbase - Processing”, directly referencing the legitimate Coinbase brand, and the intelligence classifies the activity as a crypto‑scam impersonating Coinbase.

Reputation services assign extremely low scores: Scamadviser 1/100 and Gridinsoft 0/100. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy. VirusTotal analysis shows that 18 of 95 scanning engines flagged the domain, and Google Safe Browsing marks it as a social‑engineering threat. The site has been taken offline, but the infrastructure artifacts remain.

Defenders should immediately add 193.23.3.108 and the domain name to deny‑list rules, monitor traffic to the associated nameservers for any new sub‑domains, and treat any inbound connections to the IP as potentially malicious. Continuous observation of newly registered domains using the same registrar or similar naming patterns is advised, as the rapid creation‑to‑use timeline suggests a copy‑cat operation targeting Coinbase users. Further investigation is required to determine whether the site hosted additional resources or redirected victims to downstream payloads, but the existing evidence is sufficient to classify the domain as a high‑risk brand‑impersonation platform.