coinsa[.]coinbasetop[.]com

This domain, coinsa.coinbasetop.com, is flagged as a high-risk brand impersonation targeting Coinbase. The domain was created on September 22, 2025, and is currently active. Analysis indicates that the site is associated with a cryptocurrency scam, as evidenced by the page title 'Xbetter'. The domain is registered through Name.com, Inc., and uses Cloudflare's DNS and HTTP/3 technologies, which are common among legitimate and malicious sites alike. The domain resolves to an IP address (188.114.97.3) located in the United States, under the ASN AS13335, which is associated with Cloudflare, Inc. The SSL certificate is issued by Google Trust Services / WE1, adding a layer of trust that may be leveraged to deceive users. However, the HTTP status code 521, which indicates a web server is down or unable to communicate, suggests that the site may not be fully operational or accessible at the moment. Despite this, the domain is still listed as active and appears on one security blocklist, indicating ongoing concern. Defenders should be cautious and monitor the domain for any changes in status or content. Given the high risk level and the impersonation of a well-known brand, it is advisable to block or restrict access to this domain to prevent potential financial losses and data breaches. Additionally, defenders should educate users about the risks of cryptocurrency scams and the importance of verifying the authenticity of websites before providing any sensitive information.