773001coinbase[.]com

This domain, 773001coinbase.com, is flagged as a brand impersonation threat targeting Coinbase, a major cryptocurrency exchange platform. Analysis indicates the domain was designed to mimic the legitimate Coinbase interface, likely to harvest user credentials or facilitate unauthorized transactions. No specific drainer kit signatures have been identified at this time, but the domain's structure and naming convention strongly suggest an intent to deceive users into believing they are interacting with the official Coinbase service.

Technical indicators reveal the domain was registered on June 23, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 192.162.199.184 and is secured with a Let's Encrypt SSL certificate, a common tactic to lend superficial legitimacy. VirusTotal detection shows 10 out of 95 security vendors flagging the domain as malicious. It appears on one security blocklist and is currently blocked by Hagezi. Google Safe Browsing (GSB) status is not explicitly listed, but the domain's inclusion on blocklists and vendor detections align with typical phishing infrastructure patterns.

As of the latest assessment, 773001coinbase.com has been taken offline, reducing immediate exposure risk. However, the domain's infrastructure remains registered and could be reactivated or repurposed for future malicious campaigns. Organizations and users are advised to maintain blocklist updates and monitor for any re-emergence of this domain or similar variants. Network defenders should inspect logs for connections to the associated IP address 192.162.199.184 and review historical traffic for potential compromise indicators. End-users should verify domain authenticity before entering credentials and enable multi-factor authentication on all financial and cryptocurrency platforms.