coinbase[.]ticket409325[.]com

The domain coinbase.ticket409325.com is classified as a brand impersonation threat, specifically targeting the cryptocurrency exchange Coinbase. This domain was registered through NameSilo, LLC, and while it is currently offline, it poses an elevated risk due to its impersonation tactics.

Analysis indicates that the domain has been flagged by 8 out of 95 security vendors on VirusTotal, suggesting a moderate level of consensus among security experts regarding its malicious nature. The domain was created on March 07, 2026, and resolves to the IP address 64.89.161.118. No SSL certificate is present, which is a common indicator of phishing sites attempting to appear legitimate. The domain appears on three security blocklists, further corroborating its malicious intent. The page title found is 'Google,' which is unusual and may be an attempt to mislead users or evade detection.

The current status of the domain is offline, which may indicate that it has been taken down by security teams or the registrar. Despite this, the infrastructure and tactics used suggest a persistent threat. Organizations and individuals should remain vigilant and continue to monitor for any signs of the domain being reactivated. Users are advised to verify the legitimacy of any Coinbase-related links or communications and report any suspicious activity to the relevant authorities.