190884coinbase[.]com

This domain is flagged as a high-risk brand impersonation threat specifically targeting Coinbase, a major cryptocurrency exchange platform. Analysis indicates the site was designed to deceive users into believing they were interacting with legitimate Coinbase services, likely to harvest login credentials or facilitate unauthorized transactions. The operational objective appears to be credential theft or crypto asset diversion, a common tactic in cryptocurrency-related fraud schemes. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 27, 2026, an unusually future-dated registration that may indicate an attempt to evade immediate detection. The domain resolved to IP address 188.114.96.3 and was hosted behind Cloudflare, a technique frequently used to obscure server origins and evade takedowns. Technologies detected include Node.js, Express, and Cloudflare Browser Insights, suggesting a modern, scripted backend likely designed for rapid deployment and scalability. The page title 'Mailforge | Gmail' further indicates an attempt to mimic email-related services, potentially as a lure for phishing campaigns. The domain is currently flagged by 18 out of 95 security vendors on VirusTotal, appears on three security blocklists, and holds a Gridinsoft trust score of 0/100. It is blocked by multiple security platforms, confirming its malicious classification. The domain has since been taken offline, though similar infrastructure may re-emerge under different names. Users who may have interacted with this domain should immediately revoke any active sessions, reset passwords for Coinbase and associated email accounts, and enable multi-factor authentication (MFA) using app-based or hardware tokens rather than SMS. Cryptocurrency wallet holders should review transaction histories for unauthorized transfers and consider migrating assets to new wallet addresses if compromise is suspected. Organizations should add the domain and its resolved IP (188.114.96.3) to internal blocklists to prevent access from corporate networks. Security teams are advised to monitor for indicators of compromise (IOCs) such as unexpected login attempts, unusual device registrations, or anomalous transaction patterns. Given the use of Cloudflare and future-dated registration, defenders should assume the threat actors may reuse infrastructure components and remain vigilant for similar domains leveraging the same registrar or hosting patterns.