ad8648[.]coinbase666[.]com

This domain is flagged as an elevated-risk brand impersonation threat targeting Coinbase users. Analysis indicates the infrastructure was designed to deceive victims into believing they were interacting with legitimate cryptocurrency exchange services, likely for credential harvesting or unauthorized financial transactions. The specific threat type involves phishing through brand spoofing, exploiting the trust associated with the Coinbase name to facilitate fraudulent activities. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain ad8648.coinbase666.com was registered through Gname.com Pte. Ltd. on May 06, 2026, and currently resolves to the IP address 104.21.55.141. Security vendors on VirusTotal flagged this domain with 16/95 detections, while it appears on at least one security blocklist and is actively blocked by PhishDestroy. The site employed Cloudflare with HTTP/3 support and used an SSL certificate issued by Google Trust Services. Additional risk signals include a Gridinsoft trust score of 0/100 and a page title indicating a server outage (coinbase666.com | 521: Web server is down), which may have been a temporary disruption during malicious operations. Mitigation steps for this threat type include immediate blocking of the domain and associated IP address (104.21.55.141) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) such as the domain name, registrar details, and SSL certificate issuer into security monitoring systems to detect related activity. Users who may have interacted with this domain should reset credentials for any cryptocurrency services, enable multi-factor authentication, and monitor financial accounts for unauthorized transactions. Security teams are advised to review logs for connections to the IP address or domain, particularly from endpoints that handle sensitive financial or authentication data.