coinbase[.]com[.]v3250[.]com

This domain, coinbase.com.v3250.com, is flagged as a generic phishing threat and is currently under investigation as of August 01, 2026. The domain was created on the same date as the report, August 01, 2026, and remains active. Infrastructure analysis reveals the domain resolves to IP address 193.111.125.8 and is registered through NameSilo, LLC. The domain uses nameservers ns1.dnsowl.com, ns2.dnsowl.com, and ns3.dnsowl.com, which are associated with the DNS Owl hosting service. The domain is listed on one security blocklist and has been blocked by PhishDestroy, indicating that at least one independent security vendor has identified it as malicious.

VirusTotal has scanned the domain across 91 vendors, with zero currently flagging it; however, the absence of detections is not proof that the domain is safe, and this should be interpreted cautiously given the active blocklist entry. The exact content hosted on the domain has not yet been analysed, so no specific page title, brand, or scam category can be confirmed from the available intelligence. The domain name includes a string resembling a well-known cryptocurrency exchange brand, but no brand or target has been explicitly identified in the supplied data, and analysis must not assume a specific impersonation without evidence. Defenders should treat this domain as a potential phishing risk due to its recent creation, active status, and blocklist presence.

Recommended actions include monitoring the domain for changes, reviewing network traffic to the associated IP address, and blocking access at the DNS or proxy level if the domain is not required for legitimate business operations. Security teams should also consider adding the IP and domain to threat intelligence feeds and conducting a deeper analysis of the hosted content once it is accessible, to determine the precise phishing vector and any associated campaign infrastructure.