h5[.]coinbasepro[.]wang

Analysis of h5.coinbasepro.wang indicates a confirmed brand-impersonation operation targeting Coinbase users. The domain was registered on February 21, 2026 and subsequently resolved to the IP address 47.237.7.12, which is assigned to AS45102 Alibaba (US) Technology Co., Ltd. and geolocated in Singapore. Infrastructure examination shows the host is part of a cloud service provider commonly leveraged for disposable malicious sites. The SSL certificate presented by the domain is identified as R13, suggesting a relatively recent issuance but offering no validation of the site's legitimacy.

Threat intelligence from VirusTotal reports that ten out of ninety-three scanning engines flagged the domain, reinforcing the suspicion of malicious intent. The site was actively blocked by the PhishDestroy community and appears on a single external security blocklist, indicating that at least one defensive organization has taken containment action. Current monitoring confirms the domain is offline, and the risk level is elevated based on its brand‑impersonation profile and crypto‑scam classification.

Defenders should continue to block the domain at network perimeters, enforce DNS sink‑holing for the associated IP range, and update endpoint protection signatures to include the observed certificate fingerprint. User‑education campaigns should warn Coinbase customers about unsolicited login prompts referencing the "coinbasepro" sub‑domain, emphasizing verification of official URLs before entering credentials. Ongoing surveillance of the IP owner and any future re‑registration attempts is recommended to pre‑empt re‑use of the same hosting infrastructure for similar campaigns.