clientcare-coinbase[.]com

The domain clientcare-coinbase.com was registered on February 21, 2026 through NiceNIC International Group Co., Limited and presently resolves to the IP address 188.114.97.3, which is owned by AS13335 Cloudflare, Inc. in the United States. DNS resolution is served by the Cloudflare nameservers mckenzie.ns.cloudflare.com and pablo.ns.cloudflare.com, and the site is delivered over HTTP/3. The TLS certificate presented is issued by Google Trust Services under the WE1 designation, indicating a legitimate certificate chain but offering no protection against abuse of the domain name itself.

An HTTP request to the site returns a 403 status code, and the page title delivered is "Sign in," consistent with attempts to lure victims into credential submission. The domain is listed on three independent security blocklists—PhishDestroy, MetaMask, and SEAL—each of which has flagged it for impersonating the Coinbase brand and categorizing it as a crypto‑related fraud. VirusTotal analysis shows that three of ninety‑three scanning engines have identified malicious activity associated with the domain, reinforcing the blocklist findings.

Current operational status is offline, which limits direct observation of the site’s content, but the combination of brand impersonation, the "Sign in" title, and the crypto scam classification provides sufficient evidence of malicious intent. Defenders should immediately add clientcare-coinbase.com to inbound and outbound deny lists, monitor the associated IP address for any re‑hosting attempts, and propagate the indicator set—including the registrar, nameserver, and TLS details—to threat‑sharing platforms. Continuous watch for new domains created by the same registrar that mimic the Coinbase brand is advisable, as the infrastructure indicates a reusable phishing kit possibly hosted behind Cloudflare’s edge network.