coinbase-branchoffice[.]com

PhishDestroy has identified coinbase-branchoffice.com as a brand impersonation threat targeting Coinbase, the popular cryptocurrency exchange. This domain was designed to deceive users into believing they were accessing a legitimate Coinbase branch office, likely to steal login credentials or cryptocurrency assets through a fake login page. Although the page currently returns a 404 Not Found status, the domain remains a significant risk due to its malicious intent and history of being flagged by security platforms.

Evidence from multiple security sources confirms the danger of this domain. VirusTotal reports that 15 out of 95 security vendors flag the domain as malicious, and Google Safe Browsing specifically marks it as phishing. The domain was registered on March 27, 2026, through Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn), a registrar often associated with malicious registrations. It appears on 3 security blocklists and is found in 1 threat intelligence pulse on AlienVault OTX. The domain resolves to IP address 154.219.101.95 and uses a Let's Encrypt SSL certificate (R13), which is common for phishing sites to appear legitimate. These technical indicators collectively paint a clear picture of a high-risk phishing infrastructure.

Users who may have visited coinbase-branchoffice.com should take immediate action to protect their accounts. If any credentials were entered, they should change their Coinbase password and enable two-factor authentication immediately. Additionally, users should monitor their accounts for unauthorized transactions and report any suspicious activity to Coinbase support. It is also advisable to run a full security scan on their devices to check for any malware or keyloggers that may have been installed. PhishDestroy recommends staying vigilant and only accessing Coinbase through its official website or verified mobile app to avoid falling victim to similar phishing attacks in the future.