sc0xgcuwib0q[.]bcoinbase[.]com

PhishDestroy identifies sc0xgcuwib0q.bcoinbase.com as an active Coinbase brand impersonation domain designed to trick users into entering login details or crypto wallet seed phrases. The domain uses bcoinbase.com as a subdomain spoof to mimic Coinbase’s official branding, creating a false sense of legitimacy. No drainer kit artifacts are detected in the current analysis, suggesting a lightweight but high-conversion social engineering operation targeting Coinbase users.

This domain was flagged on multiple security platforms with a VirusTotal detection score of 3/95, indicating it remains under the radar. The domain was registered on July 07, 2024 through DropCatch.com under 387 LLC, and resolves to IP address 103.224.212.100. It holds a Let's Encrypt SSL certificate and appears on 2 security blocklists including MetaMask and SEAL. Google Safe Browsing (GSB) status is currently under investigation.

The domain is marked as active with a risk level of under_investigation. Immediate blocking actions have been taken by MetaMask and SEAL, but the low VT detection score suggests a need for continued monitoring. Users should avoid visiting or interacting with this domain. Remaining risk is assessed as moderate due to the impersonation tactic and lack of current AV detection. All crypto users, especially Coinbase customers, are advised to verify URLs before entering credentials and enable two-factor authentication.