mail[.]securityalert-coinbase[.]com

This domain, mail.securityalert-coinbase.com, was registered on 24 November 2025 through NiceNIC International Group Co., Limited and is currently reported as offline. Infrastructure analysis shows it resolves to the IPv4 address 45.137.99.102, which is allocated to AS214209 Internet Magnate (Pty) Ltd and geolocated to Romania. The authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com. No TLS certificate is presented for the host, indicating that HTTPS is not enabled. The page title returned by the HTTP response is “MagnusBilling”, a generic billing‑software label that does not directly reference the targeted brand.

The domain is explicitly listed as impersonating Coinbase and is classified as a crypto‑scam, suggesting attempts to lure victims into fraudulent cryptocurrency transactions. Detection data indicate that the domain appears on one security blocklist and has been blocked by PhishDestroy. VirusTotal analysis reports that 13 of 95 scanning engines flagged the domain as malicious, reinforcing the suspicion of abuse. The Gridinsoft trust score is 0 out of 100, the lowest possible rating, which aligns with the observed malicious indicators. No SSL certificate, low trust score, and the presence of a generic billing page title together suggest that the site was likely used to host a counterfeit credential‑collection page or a payment‑drain module, although the exact payload has not been captured.

Given the current offline status, the full extent of the malicious content cannot be confirmed, and investigators should treat any cached or archived copies with caution. Defenders are advised to continue blocking the domain at network perimeter and DNS layers, monitor for any resurgence of the host, and incorporate the IP address 45.137.99.102 into threat‑intel feeds. Additional scrutiny of traffic to the associated name servers may reveal related infrastructure used in other Coinbase‑impersonation campaigns.