security-review-coinbase[.]com

This domain, security-review-coinbase.com, is identified as a brand impersonation threat specifically targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates the domain was designed to deceive users into believing they are interacting with legitimate Coinbase services, likely through credential harvesting or fraudulent transaction prompts. The domain is currently offline, but prior activity suggests malicious intent. Infrastructure analysis reveals the domain was registered on November 09, 2025, through NiceNIC International Group Co., Limited. It resolved to the IP address 149.50.97.208, hosted under AS201814 (MEVSPACE sp. z o.o.) in Poland. The SSL certificate was issued by Google Trust Services (WE1). Security vendors flagged the domain in 13 out of 95 VirusTotal scans, and it appeared on one security blocklist. The page title was recorded as a single dollar sign ($), a common indicator of placeholder or obfuscated content in phishing campaigns. The domain has been taken offline, reducing immediate risk to users. However, organizations should proactively block the domain and its associated IP (149.50.97.208) at the network level. Users who may have interacted with the domain should reset credentials for Coinbase and any other financial accounts accessed during the exposure window. Monitoring for unusual login attempts or transactions is recommended, particularly for accounts linked to cryptocurrency services.