548115coinbase[.]com

The domain 548115coinbase.com was registered through NiceNIC International Group Co., Limited on October 06, 2025 and currently resolves to the IP address 17.111.105.225, which belongs to Apple Inc. (AS714). The domain is hosted behind Cloudflare nameservers (cleo.ns.cloudflare.com and kallie.ns.cloudflare.com) and does not present an SSL certificate, indicating that any web service would be delivered over plain HTTP. The only visible artifact is the page title "Manage your Apple Account," which does not match the advertised brand target of Coinbase and suggests a possible attempt to harvest Apple credentials as a stepping stone for the listed crypto scam. Infrastructure analysis shows that the IP is part of a legitimate Apple hosting range, implying either a compromised Apple server or malicious DNS redirection to a benign‑looking host.

The domain has been flagged by several detection sources: it appears on one security blocklist, is blocked by PhishDestroy, and received detections from 17 of 95 security vendors on VirusTotal. Gridinsoft assigns a trust score of 0 out of 100, and the overall risk rating is elevated. The domain is currently offline, which prevents live verification of the content, but the combination of brand impersonation (Coinbase), mismatched page title (Apple), and the presence of a crypto‑related scam classification provides concrete indicators of malicious intent.

Defenders should add 548115coinbase.com to URL filtering and DNS blocklists, monitor the associated IP for any anomalous traffic, and investigate any recent Apple‑related authentication attempts that may have originated from this address. Continuous observation of the domain’s DNS records is advised, as changes could activate a new serving infrastructure. Until the site is taken down permanently, security teams should treat any traffic to the domain as hostile and advise end users to avoid any unsolicited requests to manage Apple accounts that originate from suspicious URLs.