confirm[.]invoice-coinbase[.]com

Analysis of confirm.invoice-coinbase.com indicates that the domain was registered on 21 February 2026 and is presently taken offline. The site is listed on two security blocklists, PhishDestroy and ScamSniffer, both of which classify it as a crypto‑related brand‑impersonation campaign targeting Metamask users. The page title returned from the server is “Invоice”, where the title includes a Cyrillic character that may be used to obscure detection. The SSL certificate is identified as type E5, suggesting a publicly trusted certificate but providing no additional validation of the operator.

DNS resolution points to IP address 45.89.110.15, which is hosted in the Netherlands and belongs to autonomous system AS209847 owned by WorkTitans B.V. The same IP has been observed in other malicious activity reports, reinforcing the suspicion that the infrastructure is purpose‑built for abuse. VirusTotal scans show that six out of ninety‑three antivirus engines flagged the domain, further confirming malicious intent. The combination of blocklist inclusion, the Metamask impersonation label, the crypto‑scam categorisation, and the observed infrastructure points to a coordinated attempt to lure victims into providing cryptocurrency credentials or payments.

No public content beyond the page title has been captured, so the exact phishing payload remains unknown. Defenders should continue to block the domain and the associated IP address at network perimeters, add the domain to internal threat intelligence feeds, and monitor for any re‑activation of the host. Users should be warned not to trust any invoice‑related communications that reference Coinbase or Metamask coming from this domain, and any credential submissions should be treated as compromised.