coinbasecwn[.]com

This domain, coinbasecwn.com, poses a specific threat of brand impersonation, mimicking the well-known cryptocurrency exchange Coinbase. The domain is designed to trick users into believing they are interacting with a legitimate Coinbase service, potentially leading to the theft of personal information and financial data.

Analysis indicates that 18 out of 95 security vendors on VirusTotal flag this domain as malicious, highlighting the elevated risk level associated with it. The domain was created on September 24, 2025, and is registered through Tucows Domains Inc. It appears on one security blocklist and was blocked by a security service known as PhishDestroy. The domain resolves to the IP address 199.59.243.228, which is located in the United States and is part of the AS16509 Amazon.com, Inc. network. The SSL certificate for the domain is issued by Let's Encrypt, which is a common provider for legitimate and malicious sites alike.

If users have visited coinbasecwn.com, they should immediately check their Coinbase account for any unauthorized activity and consider changing their passwords. Additionally, users should monitor their financial statements for any suspicious transactions and report any findings to their financial institutions. It is also recommended to run a comprehensive security scan on their devices to ensure no malware was installed during the visit.