pop[.]coinbaseregion[.]com

Analysis of pop.coinbaseregion.com shows the domain was registered on 21 February 2026 through Cosmotown, Inc. The authoritative name servers ns111.asurahosting.com, ns111.my-control-panel.com and ns112.asurahosting.com resolve the domain to the IPv4 address 198.251.89.229, which belongs to AS53667 (FranTech Solutions) located in the United States. HTTP probing returned a 200 OK response, indicating that a web service was reachable before the site was taken offline. No TLS certificate was presented, confirming that the service operated without encryption. The domain is classified as a crypto-related scam that impersonates the Coinbase brand, consistent with the supplied “brand target: Coinbase” and “scam type: Crypto Scam”.

Reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence in malicious intent. VirusTotal recorded a single positive detection out of 93 scanned security vendors, confirming at least one vendor flagged the domain as malicious. The domain appears on one external blocklist and is explicitly listed as blocked by the PhishDestroy service.

The overall evidence suggests that the domain was used to lure victims into a cryptocurrency‑related fraud campaign targeting Coinbase users, although the exact payload or landing page content has not been captured in the current data set. Defenders should add 198.251.89.229 and pop.coinbaseregion.com to network deny lists, ensure that any outbound connections to this IP are blocked, and continue monitoring for related infrastructure or newly observed subdomains. Because the site is currently offline, real‑time content analysis is not possible, but the combination of low trust score, brand impersonation, and vendor detections warrants continued vigilance and proactive blocking.