coinbase-bitcoin[.]com

This domain, coinbase-bitcoin.com, is currently active and impersonates the well-known cryptocurrency exchange platform Coinbase. The domain resolves to the IP address 15.197.148.33, which is located in California and is associated with AWS Global Accelerator (GLOBAL). The domain was registered through GoDaddy.com, LLC on May 15, 2026, and is using nameservers provided by domaincontrol.com. Infrastructure analysis reveals that the domain is still active and its SSL certificate is issued by GoDaddy's Go Daddy Secure Certificate Authority - G2, which may lend a false sense of security to unsuspecting users. This certificate is a common feature among legitimate domains but does not guarantee the authenticity of the site. The domain has been flagged in one threat intelligence pulse on AlienVault OTX, indicating that it is recognized as a potential threat within the security community. Additionally, it appears on three security blocklists, which include PhishDestroy, MetaMask, and SEAL. These listings suggest that the domain is likely being used for malicious activities, such as impersonation scams, where attackers attempt to deceive users into providing sensitive information or making unauthorized transactions. While the HTTP status code is 200, indicating that the site is accessible, the Gridinsoft trust score of 0/100 and the fact that 6 out of 95 security vendors on VirusTotal flag this domain as malicious further support the high risk level. Defenders should immediately block this domain at the network level and educate users about the risks of interacting with unauthorized sites that impersonate trusted brands. Monitoring for any additional indicators of compromise and implementing stringent access controls can help mitigate the potential impact of this threat. It is also advisable to cross-reference this domain with any internal threat intelligence feeds to ensure comprehensive protection.