daves-pizzas[.]xyz

Analysis of daves-pizzas.xyz indicates a confirmed brand‑impersonation campaign targeting Coinbase users. The domain was registered on August 30, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IPv6 address 2606:4700:3032::ac43:9cf2, which is hosted by Cloudflare (AS13335) in the United States. An SSL certificate labelled WE1 is present, providing transport‑level encryption but offering no authentication of the underlying content. The site’s HTTP response is currently offline, and the page title returned during the brief live window was “$PIZZA Distribution,” a name that does not correspond to any known Coinbase service.

The campaign is classified as a crypto‑scam and explicitly impersonates the Coinbase brand, as reflected in the intelligence tag “brand target: coinbase.” Reputation services assign extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100), and the domain appears on two independent blocklists, PhishDestroy and ScamSniffer. VirusTotal analysis shows that twelve of ninety‑three scanning engines flagged the domain as malicious, reinforcing the suspicion of malicious intent. At present, no additional artefacts such as malicious payloads, credential‑stealing forms, or redirection chains have been publicly disclosed, leaving the exact content and victim‑interaction flow uncertain.

Defenders should prioritize immediate blocking of the domain and its hosting IP at network perimeter devices, update endpoint protection signatures to include the observed VirusTotal detections, and monitor for newly registered domains that share the same registrar or similar naming patterns. Continuous observation of Cloudflare‑hosted IPv6 ranges associated with this ASN is advised, as threat actors frequently leverage the same infrastructure for rapid re‑deployment.