web[.]coinbaes[.]shop

Analysis of the domain web.coinbaes.shop indicates a recent cryptocurrency‑related brand impersonation campaign targeting Coinbase users. The domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and resolves to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No TLS certificate is present, implying the site was served over plain HTTP. The page title returned from the live host was “Coinbase”, matching the declared brand target and confirming a clear attempt to mislead visitors into believing the site is affiliated with the legitimate exchange. The infrastructure has been flagged by multiple defensive feeds.

PhishDestroy, MetaMask and SEAL have listed the domain as malicious, and the domain appears on three additional security blocklists. VirusTotal recorded scans from 95 anti‑malware engines without any detections at the time of analysis; however, the absence of detections does not constitute assurance of safety. The domain’s authoritative nameservers are anirban.ns.cloudflare.com and fiona.ns.cloudflare.com, both operated by Cloudflare. Current observations show the site is offline, and the threat is classified as “under investigation”.

The limited public evidence leaves several aspects uncertain, including the exact phishing kit used, the content served before takedown, and any credential‑harvesting mechanisms that may have been in place. Defenders should continue to block the domain at network perimeter and DNS layers, monitor the associated IP address for any future reuse, and keep the related blocklists updated. Additional investigation of traffic logs for connections to 188.114.96.3 may reveal further indicators of compromise. Ongoing surveillance is recommended until the investigation is closed.