coinbase-commerce[.]gives

This domain, coinbase-commerce.gives, is confirmed as a brand impersonation scam specifically targeting Coinbase users. Analysis indicates the site was designed to mimic Coinbase Commerce, likely for credential theft or fraudulent transaction authorization. The domain is currently offline but was operational during its active window, presenting a receipt-themed page titled 'Receipt for Incoming Transfer - Coinbase Commerce' to deceive victims. Infrastructure analysis reveals the domain was registered on February 09, 2026, through Global Domain Group LLC, an uncommon registrar for legitimate Coinbase-affiliated properties. It resolved to IP address 104.21.48.175, hosted on Cloudflare's network (AS13335), a common obfuscation tactic used by threat actors. The domain appears on three distinct security blocklists and is flagged by 25 of 95 VirusTotal vendors, indicating broad consensus on its malicious nature. Additional technical indicators include its inclusion in the blocklists of at least three major security frameworks, further validating its high-risk classification. While the domain is currently offline, its prior activity and infrastructure warrant continued monitoring. Organizations and users are advised to block the domain at the DNS or network level to prevent accidental access if it reactivates. Security teams should review logs for connections to 104.21.48.175 or requests to coinbase-commerce.gives, particularly those preceding February 2026. Coinbase users should be alerted to verify the authenticity of any communications or pages claiming to be from Coinbase Commerce, especially those involving transaction receipts or account verification prompts. Proactive measures include implementing strict domain validation policies and educating users on identifying brand impersonation tactics.