453241-coinbase[.]com

The domain 453241-coinbase.com is identified as a brand impersonation threat specifically targeting Coinbase users with a fake login portal. Analysis confirms the domain is currently offline but was actively used to deceive victims into entering credentials or authorizing fraudulent transactions. The threat type aligns with credential harvesting and potential cryptocurrency drainer schemes, common in crypto-related phishing attacks. Infrastructure analysis reveals the domain was created on February 21, 2026, and registered through Hello Internet Corp. It resolved to the IP address 172.67.219.103, hosted on Cloudflare infrastructure (AS13335). Detection metrics show 20 of 95 security vendors on VirusTotal flagged the domain as malicious, while Google Safe Browsing explicitly labels it as phishing. The domain appears on three security blocklists and is blocked by multiple threat intelligence feeds. Notably, the page title 'Just a moment...' suggests the use of Cloudflare protection or a placeholder page, and no SSL certificate was present, further indicating suspicious activity. Current status confirms the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the infrastructure remains a residual risk until fully dismantled. Organizations and users are advised to block the domain and IP at network and endpoint levels, monitor for credential reuse attempts, and verify all crypto transaction requests through official channels. Security teams should correlate this domain with existing phishing campaigns and update detection rules to include associated indicators such as the registrar, IP, and blocklist references.