ashot-coinbase[.]com

ashot-coinbase.com poses an elevated risk as a brand impersonation domain designed to mimic Coinbase, a leading cryptocurrency exchange. This threat specifically targets users through deceptive login portals, aiming to harvest credentials and facilitate unauthorized cryptocurrency transfers. The domain’s malicious intent is further evidenced by its active presence on two security blocklists, including detections from MetaMask and SEAL, critical tools in the Web3 security ecosystem.

PhishDestroy identifies multiple technical indicators confirming this domain’s malicious nature. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 23, 2026, the domain resolves to IP address 185.105.33.106. Security vendor analysis via VirusTotal reveals a concerning detection rate, with 19 out of 95 engines flagging the domain as malicious. The domain’s recent creation, combined with its inclusion on two blocklists and high-risk IP association, underscores its potential to deceive unsuspecting users seeking legitimate Coinbase services.

Mitigating the threat posed by ashot-coinbase.com requires immediate caution and proactive verification. Users should avoid interacting with this domain or any links associated with it, as it may lead to credential theft or unauthorized crypto transactions. Cross-referencing domains with PhishDestroy’s threat intelligence platform is strongly advised to confirm their legitimacy. Additionally, enabling multi-factor authentication (MFA) on legitimate Coinbase accounts and using hardware wallets for transactions can reduce exposure to such impersonation scams. Organizations and individuals are urged to report this domain to their security teams and update blocklists to prevent further exploitation.