coinbase-china[.]vip

This domain is flagged as a high-risk brand impersonation threat designed to deceive users by mimicking Coinbase, a legitimate cryptocurrency exchange platform. Analysis indicates the domain was specifically engineered to facilitate fraudulent financial services, including forex trading and digital asset transactions, under the guise of professional investment offerings. The page title, 'Coinbase One-stop global investment with professional forex trading and digital asset services,' directly aligns with tactics used to exploit trust in established financial brands, increasing the likelihood of user compromise through social engineering techniques. Infrastructure analysis reveals multiple technical indicators supporting the classification of this domain as malicious. The domain coinbase-china.vip resolves to the IP address 18.162.150.57 and was registered on October 30, 2025, through Gname.com Pte. Ltd. Security vendors have flagged the domain in 16 out of 95 assessments on VirusTotal, while Gridinsoft assigns a trust score of 0/100, indicating a complete lack of credibility. The domain appears on two security blocklists and is actively blocked by PhishDestroy and InversionDNS. Google Safe Browsing further classifies the domain under 'SOCIAL_ENGINEERING,' confirming its role in deceptive practices aimed at manipulating users into divulging sensitive information or transferring funds. Mitigation measures should prioritize the immediate isolation of this domain from corporate and personal networks. Organizations are advised to update firewall rules and DNS filters to block resolutions to 18.162.150.57 and any associated subdomains. Security teams should monitor for phishing attempts referencing this domain in email, SMS, or social media campaigns, particularly those promoting investment opportunities or account verification processes. End-users should be educated on recognizing brand impersonation tactics, such as unsolicited communications, urgent calls to action, and discrepancies in domain names or URLs. Given the domain's current offline status, continuous monitoring is recommended to detect potential reactivation or migration to alternative infrastructure.