case-491291[.]com

The domain case-491291.com has been identified as a high-risk brand impersonation threat targeting Coinbase, a cryptocurrency exchange platform. Analysis confirms the domain is currently offline, though prior activity involved presenting a fraudulent webpage with the title 'Coinbase,' designed to deceive users into believing they were interacting with the legitimate service. This domain represents a deliberate attempt to exploit trust in the Coinbase brand for malicious purposes, likely credential theft or unauthorized transaction facilitation. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, with a creation date of May 14, 2026, indicating a suspiciously future-dated registration. It resolves to the IP address 176.125.243.223 and has been flagged by 16 of 95 security vendors on VirusTotal. The domain appears on four distinct security blocklists and is actively blocked by multiple threat intelligence feeds, including MetaMask, PhishDestroy, SEAL, and InversionDNS. Detected technologies include Ubuntu and Nginx, suggesting a server-side infrastructure commonly associated with phishing operations. The Gridinsoft trust score for this domain is 0 out of 100, and Google Safe Browsing has classified it under 'SOCIAL_ENGINEERING,' further corroborating its malicious intent. Current status indicates the domain has been taken offline, reducing immediate risk to end users. However, the infrastructure remains a potential threat vector for future malicious campaigns. Organizations and individuals are advised to implement the following measures: block the domain and associated IP address (176.125.243.223) at the network perimeter; update endpoint protection rules to include this domain and its indicators; monitor for any re-registration or DNS changes involving this domain or similar naming patterns; and educate users on recognizing brand impersonation tactics, particularly those targeting cryptocurrency platforms. Security teams should review logs for prior connections to this domain and investigate any associated accounts for signs of compromise.