cbasecoin[.]com

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting Coinbase, a major cryptocurrency exchange platform. Analysis indicates the site mimics the Coinbase Wallet interface, as evidenced by the page title 'Base: Vorherig Coinbase Wallet – Apps bei Google Play,' suggesting an attempt to deceive users into believing it is an official or previously associated Coinbase application. The threat type aligns with credential harvesting and potential crypto asset theft, commonly executed through fake login portals or wallet impersonation schemes. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain cbasecoin.com was registered on November 13, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 142.251.140.174, which is linked to legitimate infrastructure but has been co-opted for malicious purposes in this instance. Security vendor detections on VirusTotal report 8 out of 95 engines flagging the domain, while Gridinsoft assigns a trust score of 0/100. The domain appears on at least one security blocklist and is actively blocked by PhishDestroy. The combination of recent registration, low trust scores, and vendor detections strongly supports the classification of this domain as malicious. Mitigation steps for users and organizations include immediate blocking of the domain at the network level, particularly in environments where cryptocurrency-related activities occur. Users who may have interacted with the site should revoke any connected wallet permissions, reset credentials for associated accounts, and monitor for unauthorized transactions. Security teams should prioritize hunting for related indicators, including the IP address 142.251.140.174 and the registrar Gname.com Pte. Ltd., in historical logs to identify potential compromise. Employee training should emphasize verification of official domains and the risks of interacting with unsolicited crypto wallet or exchange links, especially those promoted through third-party app stores or non-official channels.