coinzboase[.]com

This domain, coinzboase.com, is flagged as a brand_impersonation threat targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates the site was designed to deceive users into believing they were accessing legitimate Coinbase services, likely to harvest credentials or distribute malicious payloads. No specific drainer kit signatures were identified, but the domain’s infrastructure aligns with known phishing campaigns targeting financial services. Infrastructure analysis reveals the domain was registered through Dynadot LLC on February 07, 2025, and resolved to the IP address 103.246.244.58. At the time of assessment, VirusTotal reported 4 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and was actively blocked by PhishDestroy. Technologies detected include Microsoft ASP.NET and Kestrel, which are consistent with server-side components used in phishing operations. Google Safe Browsing (GSB) does not currently list the domain, though this may reflect its recent takedown rather than a clean status. As of the latest verification, coinzboase.com is offline, returning a 502 Bad Gateway error. This suggests the hosting infrastructure may have been disabled or the domain suspended by the registrar. While the immediate threat appears mitigated, residual risk remains for users who may have interacted with the domain prior to its takedown. Organizations are advised to monitor for credential reuse attempts and review logs for connections to 103.246.244.58 or the domain itself. Users should verify the authenticity of cryptocurrency platforms by cross-checking URLs with official sources and enabling multi-factor authentication to mitigate account compromise risks.