coinbase[.]com-clientid-567333ff44[.]xyz

This domain is flagged as an elevated-risk phishing resource specifically designed for credential harvesting under the guise of Coinbase, a major cryptocurrency exchange platform. Analysis indicates the infrastructure was established to deceive users into submitting sensitive login details, including usernames, passwords, and potentially multi-factor authentication codes, by mimicking legitimate Coinbase authentication workflows. Infrastructure analysis reveals the domain coinbase.com-clientid-567333ff44.xyz was registered on March 27, 2026, through NameSilo, LLC, a registrar frequently associated with transient phishing domains. The domain resolves to the IP address 195.20.18.202, a host previously linked to multiple brand impersonation campaigns. Detection metrics show 15 out of 95 security vendors on a major scanning platform have flagged this domain as malicious. It appears on one security blocklist and has been actively blocked by enterprise-level phishing detection systems. The domain is currently offline, though its registration remains active, suggesting potential for future reactivation. Mitigation against this specific threat type requires immediate domain invalidation and user education. Organizations should ensure endpoint protection systems are configured to block domains registered through high-risk registrars and resolve to known malicious IPs. Users should be trained to verify domain authenticity by inspecting subdomain structures and cross-referencing with official service URLs. Network-level filtering should be implemented to prevent resolution of domains created within the past 90 days that impersonate financial service brands. Security teams are advised to monitor for similar patterns involving the IP 195.20.18.202 and registrar NameSilo, LLC in future threat intelligence feeds.