76372coinbase[.]com

The domain 76372coinbase.com was registered on March 06, 2026 through NiceNIC International Group Co., Limited and is currently taken offline. DNS resolution points to the IP address 104.21.72.63, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The authoritative nameservers are rohin.ns.cloudflare.com and tina.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. No SSL/TLS certificate was observed for the host, meaning HTTPS connections would be untrusted or unavailable.

The page title returned from the site, "Sign in - Coinbase," directly references the Coinbase brand, confirming a brand‑impersonation intent. VirusTotal recorded 12 detections out of 94 scanned security vendors, and Google Safe Browsing flags the domain for social engineering, reinforcing the malicious classification. The domain appears on three independent security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, all of which categorize it as a crypto‑related scam. The overall risk rating is high, reflecting the combination of brand spoofing, lack of transport security, and multiple vendor detections.

Uncertainty remains regarding the exact phishing kit or payload, as no additional content analysis has been disclosed. Defenders should continue to block the domain at network perimeter devices, update URL filtering and threat intelligence feeds, and monitor for any resurgence of the domain or similar patterns that reuse the same registrar or Cloudflare name‑servers. Continuous verification of SSL status and page content, if the domain reappears, will be required to confirm any changes in the threat posture.