login-coinbasa.com: Confirmed Fake Exchange Scam

The domain login-coinbasa.com was registered on 9 December 2025 through Metaregistrar BV. Its authoritative name servers, aldo.ns.cloudflare.com and ximena.ns.cloudflare.com, resolve the domain to the Cloudflare edge address 172.67.157.226, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is presented, indicating that the site was served without HTTPS encryption at the time of observation. The site’s HTTP response returned the page title “Site is created successfully!”, a generic string that does not reveal functional content. VirusTotal analysis shows that seven of ninety‑five scanned security vendors flagged the domain as malicious, providing independent corroboration of its illicit nature.

AlienVault Open Threat Exchange lists the domain in a single threat‑intel pulse, and the domain appears on one public blocklist. Independent anti‑phishing services, including PhishDestroy, have already blocked the domain. The Gridinsoft trust score of 0 out of 100 further reflects a lack of trust. Brand targeting is explicit: the domain is identified as impersonating Coinbase and is categorized as a “Fake Exchange” scam. The combination of brand impersonation, low trust scores, multiple vendor detections, and blocklist listings suggests the domain was used to lure victims into providing cryptocurrency credentials or funds.

The current status is reported as offline, indicating that the malicious infrastructure has been taken down or is no longer reachable. Uncertainty remains regarding the exact payload delivered to victims, as the page title provides no insight into the user‑facing content. No evidence of a valid SSL certificate, nor any observed login form, can be confirmed without direct inspection of the live site. Defenders should continue to monitor the IP address 172.67.157.226 for any reuse, enforce blocklist updates that include login-coinbasa.