947839-coinbase[.]com

The domain 947839-coinbase.com is assessed as a high-risk brand impersonation threat targeting Coinbase. This domain poses a significant risk to users who may be tricked into believing they are interacting with a legitimate Coinbase service, potentially leading to the compromise of sensitive information such as login credentials and personal data.

Analysis indicates that the domain 947839-coinbase.com was created on January 25, 2026. It has been flagged by 23 out of 95 security vendors on VirusTotal, suggesting a moderate level of detection and potential threat. The domain is registered through Name.com, Inc., and resolves to the IP address 64.29.17.65, which is located in the United States and is part of the AS16509 network operated by Amazon.com, Inc. The domain appears on three security blocklists and has been taken offline. Google Safe Browsing has also flagged this domain as a phishing site. The SSL certificate is issued by Let's Encrypt, which is a common choice for legitimate and malicious sites alike.

To mitigate the risk associated with this brand impersonation threat, users are advised to verify the URL of any Coinbase-related site they visit. Always ensure that the domain matches the official Coinbase URL and that the SSL certificate is valid and issued to the correct entity. Organizations should update their security policies to include this domain in their blocklists and conduct regular security awareness training to educate employees about the dangers of phishing and brand impersonation. Additionally, implementing multi-factor authentication (MFA) can significantly reduce the risk of account compromise even if credentials are stolen.