coinbase-pt[.]vip

This domain, coinbase-pt.vip, is identified as a high-risk brand impersonation threat specifically targeting Coinbase, a major cryptocurrency exchange platform. The domain was operational but has since been taken offline, though its infrastructure and historical activity remain relevant for security analysis. Analysis indicates the domain was flagged by 18 of 95 security vendors on VirusTotal, reflecting broad detection across multiple threat intelligence sources. It was registered through Gname.com Pte. Ltd. on December 20, 2025, and resolved to the IP address 207.56.10.211, hosted under AS54801 (Zillion Network Inc.) in Hong Kong. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. Its SSL certificate was issued by Let's Encrypt (R13), a common tactic among threat actors to lend superficial legitimacy to malicious sites. Current status confirms the domain has been taken offline, likely due to enforcement actions or infrastructure takedowns. However, the technical indicators—such as the IP address, registrar, and creation date—remain critical for ongoing monitoring. Organizations and users are advised to block the domain and its associated IP at the network level, update endpoint protection rules to include this indicator of compromise, and conduct retrospective log analysis to identify any prior interactions. Users should also verify the authenticity of communications claiming to originate from Coinbase by cross-referencing official domains and enabling multi-factor authentication to mitigate credential theft risks.