coinbase[.]90547[.]top

The domain coinbase.90547.top is currently active and has been classified as a high‑risk brand‑impersonation campaign targeting Coinbase. Registration data shows the domain was created on 24 November 2025 through the registrar Spaceship, Inc. The authoritative nameservers are andy.ns.cloudflare.com and elinore.ns.cloudflare.com, indicating the use of a widely‑deployed DNS service. DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 label, and HTTP headers reveal the presence of HSTS, Cloudflare caching, and HTTP/3 support. An HTTP request returns status code 200 and the page title is "welcome," but no further content analysis is available. Reputation scoring from Gridinsoft assigns a trust score of 0 / 100, and four of ninety‑five VirusTotal scanners have flagged the domain, suggesting malicious intent. The domain is listed on a single security blocklist and has already been blocked by the PhishDestroy mitigation system. The campaign is described as a crypto‑scam, consistent with the Coinbase brand target. Uncertainty remains regarding the exact phishing workflow, credential capture mechanisms, and any post‑compromise payloads, as no visual or functional details have been observed. Defenders should add the domain and its resolving IP to outbound filtering rules, monitor DNS queries for the associated Cloudflare nameservers, and ensure that any inbound traffic to the IP is blocked at the perimeter. Continuous threat‑intel feeds should be consulted for updates, and incident response teams should be prepared to handle potential credential theft attempts involving Coinbase accounts.