coinbase[.]com[.]v3242[.]com

This domain, coinbase.com.v3242.com, was registered on July 31, 2026, through NAMECHEAP INC and is currently active. Infrastructure analysis reveals it resolves to the IP address 193.111.125.8, with nameservers dns1.registrar-servers.com and dns2.registrar-servers.com. The page title, 'Coinbase Wallet Security Update — Protect Your Assets,' indicates an attempt to impersonate Coinbase, a cryptocurrency exchange platform, likely targeting users with a fraudulent security alert or credential harvesting scheme.

The domain appears on one security blocklist, specifically PhishDestroy, which has flagged it as malicious. No detections were recorded by the 91 vendors that scanned the domain on VirusTotal at the time of analysis, though the absence of detections does not confirm safety and should not be interpreted as an all-clear. Defenders should note that the domain remains active and unblocked by most security vendors, increasing the risk of exposure to end users.

Given the registration date aligns with the report date, this infrastructure is likely newly deployed, and further monitoring is warranted. Organizations should consider blocking the domain at the network level and alerting users to the potential threat, particularly those interacting with cryptocurrency platforms. Additional investigation into the hosting IP (193.111.125.8) and registrar details may reveal related malicious infrastructure or patterns of abuse.