coinbasecontractrading[.]top

The domain coinbasecontractrading.top is identified as a brand impersonation threat specifically targeting Coinbase, a cryptocurrency exchange platform. This domain was designed to mimic Coinbase’s contract trading services, as evidenced by its page title, 'Coinbase contract.' Currently, the domain is offline, but its prior activity and infrastructure warrant close scrutiny. Analysis of this domain reveals multiple technical indicators of malicious intent. It was flagged by 13 of 95 security vendors on VirusTotal, indicating widespread detection as a phishing or fraudulent resource. The domain was registered through Gname.com Pte. Ltd. on June 15, 2026, and resolved to the IP address 188.114.97.3. It appears on three security blocklists, further confirming its association with malicious activity. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as threat actors frequently use valid certificates to lend credibility to fraudulent sites. Given its current offline status, this domain does not pose an immediate active threat. However, the infrastructure and registration details suggest it was part of a broader campaign to deceive users into disclosing sensitive information or transferring funds. Organizations and individuals are advised to block this domain at the network level and monitor for related domains using similar naming conventions or infrastructure. Users who may have interacted with this domain should review account activity for unauthorized transactions and reset credentials for any associated accounts. Proactive monitoring of blocklists and threat intelligence feeds is recommended to detect resurgence or similar threats.