8563-coinbase[.]com

This domain is flagged as a high-risk credential harvesting and brand impersonation threat specifically targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates the infrastructure was designed to deceive users into submitting login credentials, recovery phrases, or other sensitive account information under the false pretense of official Coinbase services.

Infrastructure analysis reveals multiple technical indicators of malicious intent: the domain resolves to IP 203.159.90.28 (AS210558, 1337 Services GmbH, Netherlands), lacks SSL encryption, and displays a page title 'WASP Panel'—a known phishing kit interface. The domain was registered on March 14, 2026, through Metaregistrar BV and is currently offline. Detection metrics include 22/95 security vendor flags on VirusTotal and presence on three security blocklists (PhishDestroy, MetaMask, and SEAL). The creation date in 2026 suggests either a typographical error in records or potential pre-registration for future malicious campaigns.

Mitigation requires immediate action from both users and security teams. Users who accessed this domain should assume credential compromise and initiate password resets across all accounts using similar authentication details, with priority given to financial and cryptocurrency platforms. Security teams should implement DNS-based blocking for the domain and its resolved IP, monitor for related subdomains using the '8563-coinbase' pattern, and deploy detection rules for 'WASP Panel' page titles in HTTP headers. Network administrators should inspect logs for connections to 203.159.90.28 and associated AS210558 infrastructure, particularly from systems handling financial or cryptocurrency transactions. Given the high-risk nature of credential harvesting, affected organizations should consider proactive account lockouts and multi-factor authentication enforcement for potentially exposed users.