dss-crown[.]coinbase[.]com[.]lc

Analysis of dss-crown.coinbase.com.lc indicates an active brand‑impersonation campaign targeting Coinbase users. The domain resolves to 75.2.18.233, an Amazon.com, Inc. (AS16509) host located in the United States. Infrastructure details show a single MX record pointing to mx156.hostedmxserver.com (priority 10) and a Let's Encrypt R13 certificate, which does not provide any reputational assurance. Web server fingerprints reveal Nginx with OpenResty, returning HTTP 200 for the root request, and the page title is observed as "coinbase.com.lc". Google Safe Browsing flags the site under the SOCIAL_ENGINEERING category, and Gridinsoft assigns a trust score of 0/100. VirusTotal records 10 of 95 security vendors flagging the domain, confirming malicious intent. The domain is already blocked by PhishDestroy and appears on one external security blocklist. While the exact page content has not been examined, the combination of brand targeting, crypto‑scam classification, and multiple detection signals classifies the domain as high‑risk. Defenders should immediately block DNS resolution and HTTP traffic to 75.2.18.233, add the domain to intrusion‑prevention signatures, and monitor for related sub‑domains or infrastructure reuse. Continuous re‑evaluation is advised in case additional indicators emerge.