coinbase[.]com-992057[.]net

The domain coinbase.com-992057.net has been identified as a brand impersonation threat targeting Coinbase. The current status of this domain is taken down, indicating that it is no longer active or accessible. This domain poses an elevated risk level due to its impersonation of a well-known cryptocurrency exchange platform, which can lead to significant financial and reputational damage if users are deceived.

Analysis of the domain reveals that it is flagged by 4 of 95 VirusTotal vendors, suggesting that while the majority of security vendors did not detect a threat, a notable minority identified potential risks. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 64.89.161.118. It was created on April 30, 2026, and appears on 3 security blocklists, further indicating its suspicious nature. The domain utilizes technologies such as Google Web Server, HSTS, and HTTP/3, and has an SSL certificate issued by Let's Encrypt. The Gridinsoft trust score for this domain is 0/100, reflecting a complete lack of trust and high likelihood of malicious intent.

Given the current status of the domain as taken down, it is recommended that organizations and individuals continue to monitor for any signs of reactivation or similar impersonation attempts. Security teams should ensure that their network defenses and user education programs are robust enough to detect and prevent such threats. Additionally, users should be cautious when clicking on links or entering sensitive information on websites that appear to mimic legitimate brand domains, and should always verify the URL and SSL certificate of the site they are visiting.