admin[.]coinbasefinancedepartment[.]art

This domain, admin.coinbasefinancedepartment.art, is actively engaged in a high-risk crypto scam impersonating Coinbase, as indicated by its registration details and infrastructure. Analysis reveals the domain was created on June 28, 2025, through Dynadot LLC and currently resolves to IP address 75.2.115.196, hosted on Amazon.com, Inc. (AS16509) in the United States. The domain uses nameservers ns1.dyna-ns.net and ns2.dyna-ns.net, consistent with registrar-provided infrastructure. A Let's Encrypt SSL certificate (YR2) is present, providing HTTPS encryption, which is commonly exploited to lend false legitimacy to phishing sites. The page title, coinbasefinancedepartment.art, explicitly references Coinbase, reinforcing the brand impersonation identified in the threat classification. As of July 12, 2026, the domain remains active with an HTTP 200 status, indicating a live and operational scam site. Detection data from security vendors shows 7 of 95 flagging the domain as malicious, and it appears on at least one security blocklist. The Gridinsoft trust score of 0/100 further supports the assessment of malicious intent. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where cryptocurrency transactions or Coinbase-related activity occurs. The use of a recently registered domain with a finance-related subdomain structure is a common tactic to deceive users into believing the site is an official financial portal. While the exact content and functionality of the site have not been analyzed, the combination of brand impersonation, crypto scam classification, and active hosting infrastructure warrants immediate mitigation. Monitoring for related domains registered through the same registrar or resolving to the same IP may help identify additional threats in this campaign.