live-vespa-qrs-private[.]coinbase[.]com[.]lc

The domain live-vespa-qrs-private.coinbase.com.lc is currently active and classified as high‑risk brand‑impersonation targeting Coinbase. DNS resolution points to 75.2.18.233, an address owned by Amazon.com, Inc. (AS16509) located in the United States. HTTP requests return status 200 and the server stack reports Nginx with OpenResty, secured with a Let’s Encrypt R13 certificate. The page title returned by the host is "coinbase.com.lc", matching the known impersonation pattern. Google Safe Browsing lists the domain under the SOCIAL_ENGINEERING category, and VirusTotal records 16 of 95 security vendors flagging it as malicious. Additional intelligence shows inclusion on a single external blocklist and a Gridinsoft trust score of 0 / 100. The site has been blocked by PhishDestroy, confirming its use in phishing campaigns. Evidence points to a crypto‑scam operation, but the exact payload or credential‑harvesting mechanisms have not been publicly disclosed. Analysts should treat any traffic to this domain as hostile. Recommended mitigations include adding the domain to DNS and web‑filter deny lists, monitoring outbound connections to the associated IP, and employing endpoint protection that references the Google Safe Browsing and VirusTotal indicators. Continuous observation of the IP and ASN reputation is advised, as infrastructure may be reused for future impersonation attempts.